Declare run_only_one as a scheme argument for geoipupdate_input

.github/workflows/lint.yml

@@ -35,4 +35,4 @@ jobs:
         run: ./build.sh
 
       - name: AppInspect
-        run: precious lint --command appinspect geoip-1.1.1.tar.gz
+        run: precious lint --command appinspect geoip-1.1.2.tar.gz

CHANGELOG.md

@@ -1,5 +1,19 @@
 # Changelog
 
+## 1.1.2 (2026-06-25)
+
+* Declare `run_only_one` as a scheme argument in the `geoipupdate_input`
+  modular input's Python scheme (`get_scheme`), in addition to the
+  `inputs.conf.spec` entry added in 1.1.1. Splunk appears to only honor
+  modular input settings other than the standard `name`, `interval`,
+  `index`, and `sourcetype` when they are declared as scheme arguments, so
+  setting `run_only_one` in `inputs.conf` alone was not enough for it to
+  take effect. Splunk's own add-ons (for example, the Splunk Add-on for
+  CrowdStrike FDR) declare `run_only_one` this way. On Splunk Cloud
+  Victoria this appears to be required for `run_only_one = false` to be
+  respected so that each search head cluster member runs the input and
+  downloads its own databases.
+
 ## 1.1.1 (2026-06-23)
 
 * Declare the `interval`, `disabled`, and `run_only_one` settings in the

build.sh

@@ -4,7 +4,7 @@ set -eu -o pipefail
 
 rm -rf output *.tar.gz
 find geoip/package -type d -name "__pycache__" -prune -exec rm -rf {} +
-uv run -- ucc-gen build --source geoip/package --ta-version 1.1.1
+uv run -- ucc-gen build --source geoip/package --ta-version 1.1.2
 
 # Clean up pip-installed files that AppInspect doesn't like
 # - .hash directories from aiohttp (Cython build artifacts)

geoip/globalConfig.json

@@ -95,7 +95,7 @@
     "meta": {
         "name": "geoip",
         "restRoot": "geoip",
-        "version": "1.1.1",
+        "version": "1.1.2",
         "displayName": "MaxMind GeoIP App",
         "schemaVersion": "0.0.10",
         "supportedThemes": [

geoip/package/app.manifest

@@ -5,7 +5,7 @@
         "id": {
             "group": null,
             "name": "geoip",
-            "version": "1.1.1"
+            "version": "1.1.2"
         },
         "author": [
             {

geoip/package/bin/geoipupdate_input.py

@@ -47,7 +47,7 @@ def get_scheme(self) -> dict[str, object]:
             "use_external_validation": False,
             "streaming_mode_xml": True,
             "use_single_instance": False,
-            "args": [],
+            "args": ["run_only_one"],
         }
 
     def validate_input(self, definition: object) -> None:
@@ -247,7 +247,11 @@ async def _download() -> list[UpdateResult]:
 # Entry point for Splunk modular input
 if __name__ == "__main__":
     # Import here to avoid issues when module is imported for testing
-    from splunklib.modularinput import Scheme, Script  # type: ignore[import-not-found]
+    from splunklib.modularinput import (  # type: ignore[import-not-found]
+        Argument,
+        Scheme,
+        Script,
+    )
 
     class GeoIPUpdateScript(GeoIPUpdateInput, Script):  # type: ignore[misc]
         """Splunk modular input script.
@@ -267,6 +271,12 @@ def get_scheme(self) -> Scheme:
             scheme.use_external_validation = False
             scheme.streaming_mode = Scheme.streaming_mode_xml
             scheme.use_single_instance = False
+            # Declare run_only_one so Splunk recognizes it as a parameter of
+            # this modular input. On Splunk Cloud Victoria this is required for
+            # the inputs.conf run_only_one value to be honored; with
+            # run_only_one = false, each search head cluster member runs the
+            # input and downloads its own databases.
+            scheme.add_argument(Argument("run_only_one", required_on_create=False))
             return scheme
 
     sys.exit(GeoIPUpdateScript().run(sys.argv))

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "maxmind-splunk-app"
-version = "1.1.1"
+version = "1.1.2"
 description = "MaxMind database lookups in Splunk"
 readme = "README.md"
 license = "Apache-2.0 OR MIT"

tests/geoipupdate_input_test.py

@@ -76,7 +76,7 @@ def test_get_scheme() -> None:
     assert scheme["use_external_validation"] is False
     assert scheme["streaming_mode_xml"] is True
     assert scheme["use_single_instance"] is False
-    assert scheme["args"] == []
+    assert scheme["args"] == ["run_only_one"]
 
 
 def test_validate_input_does_nothing() -> None: