topic Run a script after Splunk service stops in Getting Data In

Run a script after Splunk service stops

cboillot — Fri, 15 Oct 2021 20:59:24 GMT

If I were to have the UF run a PowerShell script, and that script stops the UF, does that also end that PowerShell script session? If so, is there a way to keep it running?

Re: Run a script after Splunk service stops

gcusello — Sat, 16 Oct 2021 10:03:56 GMT

Hi @cboillot,

sorry but using Splunk you cannot run actions on Universal Forwarders, you have to find a different way.

As a workaround, you could create an alert on the Splunk server that runs a remote Powershell script, if acceptable for you.

Ciao.

Giuseppe

Re: Run a script after Splunk service stops

scelikok — Sat, 16 Oct 2021 17:42:27 GMT

Hi @cboillot,

I think you are trying to run a script to change setting UF and restart. Stopping the UF process will also stop the Powershell script since it is a child.

You can continue your Powershell actions using another Powershell script by starting a second script for stopping or restarting UF. You should start the second one using the "Start-Process" command. This command will create a separate process that will not be the child of UF.

Re: Run a script after Splunk service stops

cboillot — Mon, 18 Oct 2021 18:17:22 GMT

This is what I had thought, but its not working. It gets to the point were it stops Splunk, but then nothing. The file I have in referenced in the inputs is named 'kickoff.ps1'.

start-process powershell.exe "-noexit -noprofile -executionpolicy bypass . C:\SplunkUniversalForwarder\etc\apps\upgradeTest\bin\splunkforwarder-install.ps1"

This is working as it the referenced script stops Splunk. But after that, it just stops. The script itself works as I can run it from the desktop successfully.