interval as a data input parameter

[shai]

I want my customer to be able to set the "interval" and control how frequent the module runs.

I started with this:

default/inputs.conf

[app_name]
interval = 43200

and it worked as a default fallback, but once I added it to inputs.conf.spec, things started to break

[app_name://<name>]
interval = <integer>

The value was ignored. I tried 30 for every 30 seconds and tracked logs. further more I had this log message in my server:

Ignoring parameter "interval" for modular input "app_name" when scheduling the runtime for script="/opt/splunk/etc/apps/app_name/bin/script_name.py". This means potentially Splunk won't be restarting it in case it gets terminated.

What is the way to expose "interval" to end user?
(Ideally in "more options" at the Add Input UI. )

[tscroggins]

Hi @shai,

Looking at https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/custominputs/modinputsconfspec/, the interval setting should "just work;" however, the use_single_instance scheme parameter controls its behavior.

Is use_single_instance set to false in your modular input's scheme? E.g.:

<scheme>
    <!-- ... -->
    <use_single_instance>false</use_single_instance>
    <!-- ... -->
</scheme>

[shai]

That's helpful to understand the problem!

Still I don't fully understand the solusion.

What are my options if I want to expose interval to client and still keep application single instance?

[sainag_splunk]

Hello @shai have you also tried using cron job? Yes we need to define modinput on the inputs.conf.spec to get that populated on UI.
Can you also try with local/inputs.conf?  What version of splunk are  you running? I don't recall this must be an old known issue for windows. I recommend reaching out to support if your are stuck.


If this Helps, Please Upvote.

[shai]

@sainag_splunk 

not sure what you meant by using cron job... when interval is defined in default/inputs.conf it is already activating a crod job behind the scenes... only when exposed to UI thorugh inputs.conf.spec it stops doing so...

 local/inputs.conf get's populated alright so idk what did you mean by trying it... after the user populates in the UI it is written into local/inputs.conf and then nothing happens.

I use splunk 9.2.1 over linux.