topic Re: How to troubleshoot why my PowerShell scripted input is not being run? in Getting Data In

How to troubleshoot why my PowerShell scripted input is not being run?

mark19632 — Thu, 17 Dec 2015 14:01:58 GMT

I've set up a new scripted input using powershell as follows:

Inputs.conf:

[script://$SPLUNK_HOME\bin\scripts\RESENDREQUEST.path]
source = RESENDREQUESTLOG
sourcetype = RESENDREQUESTLOG
interval = 10
disabled = 0

Created RESENDREQUEST.path in $SPLUNK_HOME\bin\scripts:

%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe -file "C:\Program Files\SplunkUniversalForwarder\bin\scripts\RESENDREQUEST.ps1"

Now, powershell isn't being run and I see no errors in the splunkd.log file.

Any ideas?

Thanks!

Mark

Re: How to troubleshoot why my PowerShell scripted input is not being run?

jkat54 — Thu, 17 Dec 2015 15:05:33 GMT

You can use some tools such as runas.exe or psexec.exe to run the same powershell command as the user splunk is running as to see what happens.

You may be running into an issue related to the execution policy of the machine you're on. See Get-ExecutionPolicy and Set-ExecutionPolicy.

runas.exe and psexec are console apps, so you can execute them at command prompt. Open a command prompt with administrative rights on the Universal Forwarder and try the following:

If splunk is running as system user, do this:

 psexec -i -s '"%SystemRoot%\System32\Windows\PowerShell\v1.0\powershell.exe -file "C:\Program Files\SplunkUniversalForwarder\bin\scripts\RESENDREQUEST.ps1"'

If splunk is running as another user, do this:

runas /noprofile /env /user:domain\username '"%SystemRoot%\System32\Windows\PowerShell\v1.0\powershell.exe -file "C:\Program Files\SplunkUniversalForwarder\bin\scripts\RESENDREQUEST.ps1"'

If it runs remote connections as it appears it does... you probably want to add /netonly to the runas

Re: How to troubleshoot why my PowerShell scripted input is not being run?

javiergn — Thu, 17 Dec 2015 16:19:46 GMT

If you are running 6.3 PowerShell is supported natively:
http://docs.splunk.com/Documentation/Splunk/6.3.0/Data/MonitorWindowsDatawithPowerShellscripts

If not I would probably go and install the PowerShell add-on:
https://splunkbase.splunk.com/app/1477/

If you can't (or don't want) to install the add-on, then double check paths and quotes in your scripts as this is usually the most common source of error. See this other post.

Thanks,
J

Re: How to troubleshoot why my PowerShell scripted input is not being run?

mark19632 — Thu, 17 Dec 2015 21:26:40 GMT

So it does!

All working now and much simpler.

Thanks!

Re: How to troubleshoot why my PowerShell scripted input is not being run?

javiergn — Fri, 18 Dec 2015 10:57:21 GMT

That's great news.
If you are happy with the answer then could you mark is as "answered" so that others can benefit from it?

Thanks,
J

Re: How to troubleshoot why my PowerShell scripted input is not being run?

jkat54 — Fri, 18 Dec 2015 12:00:13 GMT

He could mark it as the answer, but he might want to change his question if so.

I gave steps on troubleshooting powershell, you hit the nail on the head as to his root issue. The question doesnt mention latest Splunk.

Good to know it has native support now!

Re: How to troubleshoot why my PowerShell scripted input is not being run?

youngsuh — Thu, 04 Jan 2024 16:26:02 GMT

Monitor Windows data with PowerShell scripts - Splunk Documentation

Here is the update link to docs.