Splunk Dev

Is it possible to let app users configure the interval parameter?



I am building a modular input which grabs data from an API on a regular basis. I'd like to let the app user configure the polling interval so that they can manage it against rate limits, but I am hitting some really weird behaviour.

If I specify a value for interval in inputs.conf, but do not include interval in inputs.conf.spec, the modular input runs on schedule. Of course, this means that the interval is not configurable by the user on the data input page. However, if I include interval in inputs.conf.spec so that the user can configure it, the modular input runs once and never again.

This is reflected in the splunkd logs too - when the interval is included in inputs.conf.spec, the scheduler just shows 'run once'. If the interval is not in the spec file, the scheduler schedules the input properly.

I've tested this a few times and managed to repeatedly recreate the behaviour - and I also created a barebones input just to make sure that it wasn't something I had done in developing my input. The same problem occurred.

Does anyone know what is going on here? Is it possible to let app users configure the interval parameter?


0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...