topic Re: When executing two different PowerShell scripts in inputs.conf, why does only one script work? in Getting Data In

When executing two different PowerShell scripts in inputs.conf, why does only one script work?

Danii — Mon, 12 Dec 2016 14:39:59 GMT

Hi
I'm trying to execute 2 different powershell scripts with different sourcetypes but on the same index. one of them is running but the second does not.

moreover, when i put one of the scripts in disabled=false and the other as true, it runs ok.

did it happen to someone?

Re: When executing two different PowerShell scripts in inputs.conf, why does only one script work?

somesoni2 — Mon, 12 Dec 2016 17:03:08 GMT

Can you share your input.conf configuration (for these two scripted input)?

Re: When executing two different PowerShell scripts in inputs.conf, why does only one script work?

Danii — Tue, 29 Sep 2020 12:04:50 GMT

yeah sure, that's my input.conf:

First Script

[powershell://first_script]
script= . "$SplunkHome/etc/.... firstScript.ps1"
index= first_script

schedule = 00 4 * * *

sourcetype= first_script
disabled = false

Second Script

[powershell://second_script]
script= . "$SplunkHome/etc/.... secondScript.ps1"
index= second_script

schedule = 00 5 * * *

sourcetype= second_script
disabled = false

Re: When executing two different PowerShell scripts in inputs.conf, why does only one script work?

adayton20 — Wed, 14 Dec 2016 12:22:14 GMT

This happened to me a few months ago. I fixed it by creating a batch script to call the powershell script.

Re: When executing two different PowerShell scripts in inputs.conf, why does only one script work?

Danii — Wed, 14 Dec 2016 13:32:39 GMT

but then can i make it with two different sourcetypes?

Re: When executing two different PowerShell scripts in inputs.conf, why does only one script work?

adayton20 — Wed, 14 Dec 2016 13:40:23 GMT

Yeah, using the same method you have above. Just replace the .ps1 with the .bat which calls the .ps1. You can keep the same sourcetypes or change them at your leisure.

Re: When executing two different PowerShell scripts in inputs.conf, why does only one script work?

Danii — Wed, 14 Dec 2016 14:36:34 GMT

it brings me to splunk the bat text 😞

can you put you example please?

Re: When executing two different PowerShell scripts in inputs.conf, why does only one script work?

adayton20 — Wed, 14 Dec 2016 14:52:02 GMT

Sure, try something like this:

@echo off powershell.exe -ExecutionPolicy bypass -file "X:\Path\to\your\script.ps1"

Re: When executing two different PowerShell scripts in inputs.conf, why does only one script work?

Danii — Wed, 21 Dec 2016 13:40:17 GMT

sorry for the delay,
I've just tried it but and it does the job this time but again only for one of the scripts

Re: When executing two different PowerShell scripts in inputs.conf, why does only one script work?

adayton20 — Wed, 21 Dec 2016 15:32:32 GMT

A few things:

I think your script attribute value in the stanza might be incorrect. The forward slashes should be backslashes in a windows environment: http://docs.splunk.com/Documentation/AddOns/released/MSPowerShell/Configuration
Try the full path name, no dots.
It also appears you are missing an opening bracket [ in front of the PowerShell in the stanza header.

If it still isn't working after that:

Have you checked splunkd.log for that stanza/script for any errors? If no, try that. You can do this via the search head by looking in index=_internal sourcetype=splunkd
Do these two different scripts provide two unique outputs? Ie, do not have the same hash value?

Re: When executing two different PowerShell scripts in inputs.conf, why does only one script work?

Danii — Mon, 26 Dec 2016 07:06:44 GMT

thanks for the answer,
for the 3 first points it's OK it is like this, i was wrong while copying it.

Now the problem is that it takes both of them with bat files but it take each row as a single event.
did it happen to you somehow?

Re: When executing two different PowerShell scripts in inputs.conf, why does only one script work?

Danii — Mon, 26 Dec 2016 09:26:20 GMT

it parse each row as single event.
do you know what can I do about it?