Getting Data In

how to use the interval parameter for modular input ?

jzhong_splunk
Splunk Employee
Splunk Employee

Hi All,

I got confused while reading the documentation: http://docs.splunk.com/Documentation/Splunk/6.1.2/AdvancedDev/ModInputsSpec#interval_parameter

It says

Some parameters are always implicitly defined by Splunk. Specifying any of the following parameters for your modular inputs has no effect. However, you could specify these to help clarify the usage: .. interval

Avoid using interval as a parameter. This parameter is reserved by Splunk for future use.

Then

New with Splunk 6, you can optionally specify the interval parameter much as you can with scripted inputs.
Entering an empty value for interval results in a script only being executed on start and/or endpoint reload (on edit).

I tried to write a Java modular input for Splunk6 and use the interval=6000 in the inputs.conf.spec. According to the log, my input is only called once.

Any suggestions?

Tags (3)

schose
Builder

Hi,

The interval for a modular input is defined in inputs.conf stanza for the modular input script script.
If you modular input script is named foobar.py then you can define

inputs.conf
[foobar://myname]
interval=10
myparam1 = true

Then foobar will be executed every 10 seconds.
The documentation is quite misleading.. also have to test it out out while creating a modular input.

Regards,

Andreas

Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...