Getting Data In

scripted input cron schedule

jskopis5668
Explorer

I defined a scripted input:

[script://$SPLUNK_HOME/etc/apps/ccbn/bin/get_domain_by_date]
disabled = true
host = dbserver
index = main
interval = 0 1 * * *    #frequency to run the script
source = newman_db
sourcetype = feedback_by_domain

When I run the script I get output like this:

20110830: date=20110830,domain=aim.com,type=2,count=12
20110830: date=20110830,domain=aol.com,type=2,count=88
20110830: date=20110830,domain=aol.com,type=3,count=68
20110830: date=20110830,domain=att.net,type=2,count=35
20110830: date=20110830,domain=bellsouth.net,type=2,count=15
20110830: date=20110830,domain=bls.gov,type=2,count=11
20110830: date=20110830,domain=comcast.net,type=2,count=74
20110830: date=20110830,domain=comcast.net,type=3,count=27
20110830: date=20110830,domain=gmail.com,type=2,count=31
20110830: date=20110830,domain=hotmail.com,type=2,count=439
20110830: date=20110830,domain=hotmail.com,type=3,count=164
20110830: date=20110830,domain=irs.gov,type=1,count=14
20110830: date=20110830,domain=live.com,type=2,count=77
20110830: date=20110830,domain=live.com,type=3,count=12
20110830: date=20110830,domain=msn.com,type=2,count=13
20110830: date=20110830,domain=msn.com,type=3,count=17
20110830: date=20110830,domain=optonline.net,type=2,count=11
20110830: date=20110830,domain=sbcglobal.net,type=2,count=32
20110830: date=20110830,domain=sbcglobal.net,type=3,count=15
20110830: date=20110830,domain=verizon.net,type=2,count=47
20110830: date=20110830,domain=yahoo.ca,type=3,count=54
20110830: date=20110830,domain=yahoo.com,type=2,count=642
20110830: date=20110830,domain=yahoo.com,type=3,count=310
20110830: date=20110830,domain=ymail.com,type=2,count=33
20110830: date=20110830,domain=ymail.com,type=3,count=14

However splunkd seems to be running the script every one second. This causes many duplicate events. I want the script to run once a day as it outputs counts of feedback events for the previous day.

How can I make the script run once a day after midnight?

Tags (1)
1 Solution

Drainy
Champion

This is what you have defined in inputs.conf? The cron statement looks fine. Perhaps remove the comment in-case it isn't agreeing with it (or move it to a newline) and hardcode disabled as 0 to enable the script.

Also, does the script itself end?
If your script does not terminate itself then using cron will only check if it is still running or not which makes defining an interval irrelevant. I have previously had instances where I made a script that never terminated which resulted in many duplicates which I assumed was the interval playing up, but was in fact my script.

View solution in original post

Drainy
Champion

This is what you have defined in inputs.conf? The cron statement looks fine. Perhaps remove the comment in-case it isn't agreeing with it (or move it to a newline) and hardcode disabled as 0 to enable the script.

Also, does the script itself end?
If your script does not terminate itself then using cron will only check if it is still running or not which makes defining an interval irrelevant. I have previously had instances where I made a script that never terminated which resulted in many duplicates which I assumed was the interval playing up, but was in fact my script.

jskopis5668
Explorer

Getting rid of the comment after the cronspec, deleting whitespace before/after the '=' seemed to do the trick. odd.

thanks

t9445
Path Finder

Interesting - running UF v7.1.2 on linux and this issue has come back - was previously fixed -- re-updating inputs.conf scripts to not have any whitespace for the interval (e.g. interval=300 <- always works, interval = 300 <- does not always work)

0 Karma

bruceclarke
Contributor

I appear to have had the same issue earlier today (almost 7 years later).

It is pretty incredible that this appears to still be an issue for Splunk so far later. I have filed a support ticket to fix it. (Granted it is possible that my issue is a different one)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...