Getting Data In

scripted input not following the cron schedule

meenu_2017
Engager

I have a scripted input that runs on the schedule 0 9 * * * (once a day at 9 am). This is a powershell scripted input and observing that this gets triggered multiple times if the server gets rebooted and hence the forwarder restarts. Any idea why would this happen? Universal Forwarder version - 6.6.6

0 Karma

somesoni2
Revered Legend

Ideally this should not happen, if you've specified correct Cron schedule. Does it get executed immediately after the forwarder restart? Also, does it get executed once every time forwarder restarts or multiple times?

interval = [<number>|<cron schedule>]
* How often to run the specified command (in seconds), or a valid cron
  schedule.
* NOTE: when you specify a cron schedule, the input does not run the
  script on start-up.
0 Karma

meenu_2017
Engager

Is there any difference if we specify the cron with schedule = or interval=?

0 Karma

meenu_2017
Engager

Its getting executed once immediately after forwarder restart! We have a big set of machines working as expected with the same config and a few which is showing duplicate events from multiple runs.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...