Getting Data In

how to use the interval parameter for modular input ?

jzhong_splunk
Splunk Employee
Splunk Employee

Hi All,

I got confused while reading the documentation: http://docs.splunk.com/Documentation/Splunk/6.1.2/AdvancedDev/ModInputsSpec#interval_parameter

It says

Some parameters are always implicitly defined by Splunk. Specifying any of the following parameters for your modular inputs has no effect. However, you could specify these to help clarify the usage: .. interval

Avoid using interval as a parameter. This parameter is reserved by Splunk for future use.

Then

New with Splunk 6, you can optionally specify the interval parameter much as you can with scripted inputs.
Entering an empty value for interval results in a script only being executed on start and/or endpoint reload (on edit).

I tried to write a Java modular input for Splunk6 and use the interval=6000 in the inputs.conf.spec. According to the log, my input is only called once.

Any suggestions?

Tags (3)

schose
Builder

Hi,

The interval for a modular input is defined in inputs.conf stanza for the modular input script script.
If you modular input script is named foobar.py then you can define

inputs.conf
[foobar://myname]
interval=10
myparam1 = true

Then foobar will be executed every 10 seconds.
The documentation is quite misleading.. also have to test it out out while creating a modular input.

Regards,

Andreas

Get Updates on the Splunk Community!

Leveraging Detections from the Splunk Threat Research Team & Cisco Talos

  Now On Demand  Stay ahead of today’s evolving threats with the combined power of the Splunk Threat Research ...

New in Splunk Observability Cloud: Automated Archiving for Unused Metrics

Automated Archival is a new capability within Metrics Management; which is a robust usage & cost optimization ...

Calling All Security Pros: Ready to Race Through Boston?

Hey Splunkers, .conf25 is heading to Boston and we’re kicking things off with something bold, competitive, and ...