topic Re: Separate PowerShell Objects with / for search in Getting Data In

How to separate PowerShell objects with / for search?

pamkkkkk — Fri, 28 Apr 2023 13:42:16 GMT

Hi!

I have written a PowerShell Script to obtain Hard-Disk Informations for Local Drives and report it to Splunk.

If(Get-Command -Name 'Get-CimInstance' -ErrorAction SilentlyContinue) { $Drives = Get-CimInstance -Query 'SELECT * FROM Win32_LogicalDisk WHERE DriveType=3' -QueryDialect 'WQL' } Else { $Drives = Get-WmiObject -Query 'SELECT * FROM Win32_LogicalDisk WHERE DriveType=3' } $Drives | ForEach-Object { $Drive = $_ | Select-Object FreeSpace,Size,FileSystem,VolumeSerialNumber,PercentFree,UsedGB,FreeGB,@{Name='DriveLetter';Expression={ $_.DeviceID }},IsSystemdrive $Drive.PercentFree = [Math]::Round(($Drive.FreeSpace / $Drive.Size * 100),2) $Drive.UsedGB = [Math]::Round((($Drive.Size - $Drive.FreeSpace) / 1GB),2) $Drive.FreeGB = [Math]::Round(($Drive.FreeSpace / 1GB),2) If($Drive.DriveLetter -eq $env:SystemDrive) { $Drive.IsSystemdrive = $true } Else { $Drive.IsSystemdrive = $false } $Drive }

This gives me the following result in Splunk for a System with Harddisk C and D

FreeSpace : 37910388835 Size : 106847793152 FileSystem : NTFS VolumeSerialNumber : 64A9A098 PercentFree : 53,54 UsedGB : 46,23 FreeGB : 53,28 DriveLetter : C: IsSystemdrive : True FreeSpace : 27610488832 Size : 268432306176 FileSystem : NTFS VolumeSerialNumber : E2651A32 PercentFree : 10,29 UsedGB : 224,28 FreeGB : 25,71 DriveLetter : D: IsSystemdrive : False

My Query skills are not the best ... 😞

How can I separate the PowerShell objects (Disk C: and D:) in a query?
For example; To monitor the system drive only?

This discussion is for learning, how to parse such PowerShell objects.
Not to use other workarounds.)

I'm also grateful if someone has tips on how to better prepare (separate) the PowerShell objects for Splunk searches.

Re: Separate PowerShell Objects with / for search

ITWhisperer — Fri, 28 Apr 2023 06:55:11 GMT

You could try something like this

| rex max_match=0 "(?<name>\w+)\s+:\s(?<value>.+)" | streamstats count as event | eval count=mvcount(name) | eval row=mvrange(0,count) | mvexpand row | eval name=mvindex(name,row) | eval value=mvindex(value,row) | eval {name}=value | fields - name value _raw row count | stats list(*) as * by event | eval drive=mvcount(DriveLetter) | eval row=mvrange(0,drive) | mvexpand row | rename row as _row | rename event as _event | foreach * [| eval <<FIELD>>=mvindex(<<FIELD>>,_row)] | rename _event as event

Re: Separate PowerShell Objects with / for search

pamkkkkk — Fri, 28 Apr 2023 07:03:42 GMT

Hi ITWhisperer,

Thank you for your help.

Such a complicated query monster? I hoped for an easy to understand solution.
I think the parsing cost for such a query are very high on Server or not?

I give it a try....

Re: Separate PowerShell Objects with / for search

javiergn — Fri, 28 Apr 2023 08:03:06 GMT

Hi @pamkkkkk , you could also try the following:

This is how I tested it and the output:

If you write your PS output already in key=value pairs (or key:value, or any other delimiter) it'll be easier to extract than multiline and a lot cheaper from a performance point of view.

Regards,