Getting Data In

Powershell script input on a schedule

gavsdavs_GR
Path Finder

Not sure if this is a bug or just weird behaviour, I don't seem to be able to work around it.

I have loads of powershell windows inputs running on my UFs but they are running on UF restart as well as on their schedule(s).
{code}
[powershell://name]
script = & stuff
schedule = 0 23 15 * * *
source = PowerShell
sourcetype = PowerShell:Name
index = my index
interval =
{code}

I want this ONLY to run at 15:23.
What I am seeing is that if the UF is restarted, it's run on startup, AND it's run on the schedule i tell it.
i don't want it running on UF startup.

I believe i'm using the quartz notation and that bit is working as intended, but I don't want this input to be run if the UF is restarted.

Why is this happening ?

MayurSplunk
Explorer

Please share if the issue has been resolved in later releases.

0 Karma

MayurSplunk
Explorer

Any update on this ... has it been resolved by Splunk ?

0 Karma

meglin_splunk
Splunk Employee
Splunk Employee

I believe this is a known issue. Please raise a case with Splunk Support quoting SPL-141385.

adonio
Ultra Champion

its the default behavior to run scripted inputs on forwarder start, i am not sure however how (and why) to disable it

0 Karma

gavsdavs_GR
Path Finder

That isn't very desirable. If i supply a schedule, then that's when i want it to run, not whenever the UF is restarted.

0 Karma
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...