Join the Conversation
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- interval in input.conf not followed, Windows add-o...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
interval in input.conf not followed, Windows add-on
Windows add-on 8.0.0, Splunk 8.0.4.
No matter the interval settings in inputs.conf, they seem to run at random times. For example on one host alone, the "service" checker ran 9 times in one hour. The setting in the stanza is for once a day (86400). I've tried setting it other values -- nothing seems to matter.
Also happening on all other inputs (sourcetype=WinHostMon) that have an interval setting.
Disk, for example (also set interval = 86400) is running 2-16 times for host in one hour.
I've searched for this, and heard the descriptions of the scripts "taking a long time to run" yadda, yadda... but come on, not all of them...and these aren't scripts (and we have arguably over powered hardware running this). This is generating a *lot* of entries for our small test group of only 200.
Thoughts?
Thanks.
Mike
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It all looks ok. Unless there is something that's doing an overide. can you try using btool to check if inputs are all correct.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Great suggestion on using btool...
However, it confirmed that all is good. I'm focusing on [WinHostMon://Disk] for my test case.
I definitely have:
[WinHostMon://Disk]
interval = 86400
disabled = 0
type = Disk
And definitely confirmed my system is showing data for my Name="C:" at exactly 2 hour intervals... but once in a while only waits an hour in between. Go figure.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What are the inputs.conf settings for the respective inputs and where are they set? If you use universal forwarders then the settings must be on the UFs. Be sure to restart Splunk after changing inputs.conf settings.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[WinHostMon://Disk]
interval = 86400
disabled = 0
type = Disk
...straight out-of-the-box -- (except that I enabled it and changed the interval). In these cases it's being handed out by a deployment server to UFs. Yes, I know the inputs.conf is being applied because other changes are reflected. There's only one app being applied. Yes, it's in local.
Yes, I know to restart/reload it... 😕
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas
What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)
Automating Threat Operations and Threat Hunting with Recorded Future
