Getting Data In

retrying a scripted input after a failure

Justin_Grant
Contributor

[I heard this question on an internal mailing list, but it seemed generally relevant so asking it here too]

I have a scripted input that talks to an SDEE interface on the Cisco IPS. This interface can be flakey at times and I am running into an issue where if a connection fails Splunk will no longer retry the script. I assumed with the scheduler set -1 it would just try to reconnect after the script exits. I am catching the exception and exiting gracefully but that doesn't seem to work or I am just doing it wrong. Can anyone give me a pointer as to what I need my script to do in order to get Splunk to retry it if the first connection fails.?

Tags (1)
1 Solution

gkanapathy
Splunk Employee
Splunk Employee

If you set the interval to -1, it runs the script just once, when Splunk starts up. If you set it to 1, it runs the script again 1 second after the previous invocation exits. It's generally true for all scripted inputs that the next instance runs interval seconds after the exit of the previous invocation.

View solution in original post

gkanapathy
Splunk Employee
Splunk Employee

If you set the interval to -1, it runs the script just once, when Splunk starts up. If you set it to 1, it runs the script again 1 second after the previous invocation exits. It's generally true for all scripted inputs that the next instance runs interval seconds after the exit of the previous invocation.

Will_Hayes
Splunk Employee
Splunk Employee

The interval need to be set to 1 not -1 for auto-retry on exit.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...