Splunk Dev

Is it possible to let app users configure the interval parameter?



I am building a modular input which grabs data from an API on a regular basis. I'd like to let the app user configure the polling interval so that they can manage it against rate limits, but I am hitting some really weird behaviour.

If I specify a value for interval in inputs.conf, but do not include interval in inputs.conf.spec, the modular input runs on schedule. Of course, this means that the interval is not configurable by the user on the data input page. However, if I include interval in inputs.conf.spec so that the user can configure it, the modular input runs once and never again.

This is reflected in the splunkd logs too - when the interval is included in inputs.conf.spec, the scheduler just shows 'run once'. If the interval is not in the spec file, the scheduler schedules the input properly.

I've tested this a few times and managed to repeatedly recreate the behaviour - and I also created a barebones input just to make sure that it wasn't something I had done in developing my input. The same problem occurred.

Does anyone know what is going on here? Is it possible to let app users configure the interval parameter?


0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...