topic Re: Splunk Scripting- GUI or stanza in Splunk Enterprise

Splunk Scripting- GUI or stanza

jmasat — Tue, 23 Jun 2020 17:33:03 GMT

Team,

i wish to utilize Powershell scripts, deployed to remote clients via the GUI interface - or CLI

Whichever can be made to work.

1. The CLI (Inputs.conf) works if created and maintained on each client

2. The remote script GUI only seems to work for bat files.

3. The V3 modular input only seems to work for localhost

History:

i have successfully utilized powershell scripts with in the inputs.conf (placed on each forwarder)

example :
script = . "C:\Program Files\Splunk\etc\apps\My-App\bin\script.ps1

( I chose to use the full path as the env variable does not seem to stick-- set or setx does not seem to matter)

The downfall of this is the script/ inputs.conf has to be updated manually on each client.

i have successfully utilized batch from the GUI (settings > data inputs >remote scripts)

$SPLUNK_HOME/etc/apps/_server_app_W64_NETWORK_INFO/bin/netstat.bat

Attempts with .ps1 scripts does not work.

Tried utilizing the Powershell v3 Modular Input

that method only targets the local host (server)

Re: Splunk Scripting- GUI or stanza

richgalloway — Tue, 23 Jun 2020 17:36:22 GMT

The Best Practice method to do that is by using the Deployment Server (DS) to deploy an app containing your script to the target clients. You can even tell the DS to send the app only to Windows clients. Updates to the script are easy - just update the script on the DS and the DS sends the new script to the clients.

Another popular approach is to use Ansible, Puppet, SCCM, or similar tool to deliver the script to the clients.

Re: Splunk Scripting- GUI or stanza

jmasat — Tue, 23 Jun 2020 17:47:45 GMT

i will look at the DS--

have not gone that direction yet- too new to Spunk

The other tools are not available in this environment

Re: Splunk Scripting- GUI or stanza

jmasat — Tue, 23 Jun 2020 18:17:42 GMT

DEPLOYED APPS SUCCESSFULLY

This is indicated in the edit server class pane

Is the server deploying?

As i stated batch files are working great- Powershell is not