Getting Data In

Powershell script input on a schedule

gavsdavs_GR
Path Finder

Not sure if this is a bug or just weird behaviour, I don't seem to be able to work around it.

I have loads of powershell windows inputs running on my UFs but they are running on UF restart as well as on their schedule(s).
{code}
[powershell://name]
script = & stuff
schedule = 0 23 15 * * *
source = PowerShell
sourcetype = PowerShell:Name
index = my index
interval =
{code}

I want this ONLY to run at 15:23.
What I am seeing is that if the UF is restarted, it's run on startup, AND it's run on the schedule i tell it.
i don't want it running on UF startup.

I believe i'm using the quartz notation and that bit is working as intended, but I don't want this input to be run if the UF is restarted.

Why is this happening ?

MayurSplunk
Explorer

Please share if the issue has been resolved in later releases.

0 Karma

MayurSplunk
Explorer

Any update on this ... has it been resolved by Splunk ?

0 Karma

meglin_splunk
Splunk Employee
Splunk Employee

I believe this is a known issue. Please raise a case with Splunk Support quoting SPL-141385.

adonio
Ultra Champion

its the default behavior to run scripted inputs on forwarder start, i am not sure however how (and why) to disable it

0 Karma

gavsdavs_GR
Path Finder

That isn't very desirable. If i supply a schedule, then that's when i want it to run, not whenever the UF is restarted.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...