When will the scripted input run?

[ddrillic]

We have the following -

[script://.\bin\<name>.bat]
disabled = 0
interval = 86400

Since the interval is 24 hours, when will it run? How can we set the time for it to run?

[MuS · Accepted solution]

Hi dddillic,

the interval will start when Splunk was last started. If you want more control over the schedule of your scripted input, use the crontab notation in interval. From the docs http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf :

interval = [<number>|<cron schedule>]
* How often to run the specified command (in seconds), or a valid cron schedule.
* NOTE: when you specify a cron schedule, the input does not run the script on start-up.
* If you specify the interval as a number, it may have a fractional component; e.g., 3.14
* The cron implementation for data inputs does not currently support names of months or days.
* Defaults to 60.0 seconds.
* The special value 0 forces this scripted input to be run continuously;
  that is, as soon as the script exits, the input restarts it.
* The special value -1 causes the scripted input to run once on start-up.

Hope this helps ...

cheers, MuS

[ddrillic]

Much appreciated @MuS.