There's a scripted input that I wanted to create a while ago, but it had to do some 'setup' stuff at the beginning and this setup stuff took longer than the schedule I needed to run the script on. Naturally this was problematic.
We tried briefly having the script just sleep periodically and then go back to returning data. However ExecProcessor didnt seem to like this arrangement. Specifically, none of the data we were returning out of stdout would get indexed into splunk until the script was actually killed. Is that the way it's supposed to work? This was a windows .bat file as the scripted input, and it was on Splunk 4.1.5.
So assuming I'm not crazy and by default the data doesnt get indexed until the script terminates, is there then any way in 4.1.5 or the upcoming 4.2 perhaps to have a scripted input that is constantly running and returning data rather than running on a schedule?
Ideally such a script would get somewhat managed by the ExecProcessor, ie restarted if it ever did terminate or get killed.
