Getting Data In

how to use the interval parameter for modular input ?

jzhong_splunk
Splunk Employee
Splunk Employee

Hi All,

I got confused while reading the documentation: http://docs.splunk.com/Documentation/Splunk/6.1.2/AdvancedDev/ModInputsSpec#interval_parameter

It says

Some parameters are always implicitly defined by Splunk. Specifying any of the following parameters for your modular inputs has no effect. However, you could specify these to help clarify the usage: .. interval

Avoid using interval as a parameter. This parameter is reserved by Splunk for future use.

Then

New with Splunk 6, you can optionally specify the interval parameter much as you can with scripted inputs.
Entering an empty value for interval results in a script only being executed on start and/or endpoint reload (on edit).

I tried to write a Java modular input for Splunk6 and use the interval=6000 in the inputs.conf.spec. According to the log, my input is only called once.

Any suggestions?

Tags (3)

schose
Builder

Hi,

The interval for a modular input is defined in inputs.conf stanza for the modular input script script.
If you modular input script is named foobar.py then you can define

inputs.conf
[foobar://myname]
interval=10
myparam1 = true

Then foobar will be executed every 10 seconds.
The documentation is quite misleading.. also have to test it out out while creating a modular input.

Regards,

Andreas

Get Updates on the Splunk Community!

Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Using the Splunk Threat Research Team’s Latest Security Content

REGISTER HERE Tech Talk | Security Edition Did you know the Splunk Threat Research Team regularly releases ...