topic Re: How to create a PowerShell script to list forwarder status, then restart the service if the listing failed? in All Apps and Add-ons

How to create a PowerShell script to list forwarder status, then restart the service if the listing failed?

ginger8990 — Wed, 11 May 2016 03:07:35 GMT

I want to find a script to list splunk forwarder status the restart the service if the listing failed.

$serverlist =
"C:\serverlist.txt"
Get-Content $serverlist |
foreach($comp in
$serverlist){Invoke-Command
-ComputerName $_ -FilePath "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"
-ArgumentList splunk list forward-server}
Or
$sstat = Get-Service -Name splunkd
#Checks for Service Status
#Restarts Splunk Service if it's running, or starts if it is stopped
if ($sstat.status -eq "running"){
    write-output "Restarting Splunk"
    restart-service splunkd
    }
elseif ($sstat.status -eq "stopped"){
    start-service splunkd
    write-output "Splunk is starting"
    }

Re: How to create a PowerShell script to list forwarder status, then restart the service if the listing failed?

ginger8990 — Thu, 12 May 2016 15:29:45 GMT

Splunk community is not good as spicework community, no one ever reply the Q&A.

Let me put this way: Splunk commands can support powershell? Such as splunk list forward-server is not recognized in Powershell.

Re: How to create a PowerShell script to list forwarder status, then restart the service if the listing failed?

piebob — Sun, 15 May 2016 23:02:14 GMT

I downvoted this post because http://lmgtfy.com/?q=splunk+powershell

Re: How to create a PowerShell script to list forwarder status, then restart the service if the listing failed?

jkat54 — Mon, 16 May 2016 00:36:54 GMT

Seriously... This is a loaded question. Have you ever done powershell remoting? Will you enable WinRM or use WMI? Do you know what each entails? Are you paying for the development and subsequent deployment? Or do you just expect someone to spend the next month here explaining it to you? It's hard enough to enable WinRM and double hop code execution in your own environment; let alone explain it to someone else...

Re: How to create a PowerShell script to list forwarder status, then restart the service if the listing failed?

jkat54 — Mon, 16 May 2016 00:43:23 GMT

I share code here all the time but I don't have it in me to go into the intracacies of remote code execution in a windows environment. I'll do better by you letting you figure it out yourself anyways. I think I gave enough hints by now. Best of luck.

Re: How to create a PowerShell script to list forwarder status, then restart the service if the listing failed?

ginger8990 — Mon, 16 May 2016 03:47:12 GMT

your answer is not splunk powershell related.

What you are talking about is prerequisite of using powershell...........how to you use powershell without prerequisite?

Re: How to create a PowerShell script to list forwarder status, then restart the service if the listing failed?

jkat54 — Mon, 16 May 2016 10:56:05 GMT

Example 1:

$pinfo = New-Object System.Diagnostics.ProcessStartInfo
$pinfo.FileName = 'C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe'
$pinfo.RedirectStandardError = $true
$pinfo.RedirectStandardOutput = $true
$pinfo.UseShellExecute = $false
$pinfo.Arguments = "list forward-server"
$p = New-Object System.Diagnostics.Process
$p.StartInfo = $pinfo
$p.Start() | Out-Null
$p.WaitForExit()
$stdout = $p.StandardOutput.ReadToEnd()
$stderr = $p.StandardError.ReadToEnd()
Write-Host "stdout: $stdout"
Write-Host "stderr: $stderr"
Write-Host "exit code: " + $p.ExitCode

Example 2:
`add-type @"
using System.Net;
using System.Security.Cryptography.X509Certificates;
public class TrustAllCertsPolicy : ICertificatePolicy {
public bool CheckValidationResult(
ServicePoint srvPoint, X509Certificate certificate,
WebRequest request, int certificateProblem) {
return true;
}
}
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy

$user = "admin"
$pass = convertto-securestring -AsPlainText -Force -String 'admin' #your password here
$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $user,$pass
$request = Invoke-WebRequest -uri https://localhost:8089/services/data/outputs/tcp/default -credential $cred
$request.Content
$request = Invoke-WebRequest -uri https://localhost:8089/services/data/outputs/tcp/group -credential $cred 
$request.Content
$request = Invoke-WebRequest -uri https://localhost:8089/services/data/outputs/tcp/server -credential $cred 
$request.Content
$request = Invoke-WebRequest -uri https://localhost:8089/services/data/outputs/tcp/allconnections -credential $cred 
$request.Content`

Example 3:
http://dev.splunk.com/view/splunk-powershell-resource-kit/SP-CAAADRU

Re: How to create a PowerShell script to list forwarder status, then restart the service if the listing failed?

jkat54 — Wed, 18 May 2016 02:24:18 GMT

Hey spice works guy... I have answer and you no reply for more than 1 day. Wassup?

Re: How to create a PowerShell script to list forwarder status, then restart the service if the listing failed?

jkat54 — Thu, 26 May 2016 12:51:23 GMT

$user = "admin" 
$pass = convertto-securestring -AsPlainText -Force -String 'admin' #your password here 
$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $user,$pass 
$request = Invoke-RestMethod -uri https://localhost:8089/services/data/outputs/tcp/server -credential $cred 
$request.title