How can I force a scheduled script to run when installing (or uninstalling) new software?

[joshuapetitt]

I'm using the Splunk for Windows addon on many computers. It has a scripted input for installed apps that runs once a day. Normally, this is what I want (only to collect the data once a day). However, if I am installing new software on all the computers, or uninstalling, I would like to force this script to run on all computers and send the data back to Splunk for a report.

Is this possible?

[nickhills]

If your using a deployment server, you can simply update the deployment-apps/TA/local/inputs.conf to change the interval on which the input runs.

Simply reload the deployment server, and your forwarders will update, and start sending data back more frequently.
When your done, switch it back, and reload the DS again, and your back to where you started.

[joshuapetitt]

this is an interesting solution, but seems like alot of work. This happens every few weeks, so it is often enough, I'd really like a "One Button Solution" ultimately. Maybe I need to go around the forwarder, and just have another program that does the one-shot sending?

[nickhills]

Its really not - about 20 seconds effort.
I do this all the time - testing remote data collection scripts

[nickhills]

If you want a point/click option:

create a duplicate app, where the interval is smaller.
Create a duplicate server class which assigns the new app.

from the DS UI, simply add your desired targets to the new serverclass (no need to remove them from the old)

Now you have two options - either remove the target machines when your done, or disable the server class.

Anyway the net result is the same .