Splunk PowerShell Modula Input always returns fallback result

tnicklau — Tue, 29 Sep 2020 19:28:47 GMT

Hello Community,

I have setup a PowerShell modular input; executing a script every 5 minutes.

Running the script on the splunk (enterprise) server in PS ISE - I get the following output:
host :
Server_IP :
Page_Return_Code : 200
Page_Return_Message : OK
Page_Execution_Time : 1800
Page_Login_Result : Good
source : PowerShell/Connectivity

I can assume, the script itself is working fine.

Calling the same from splunk, I get:
host=""
Server_IP=""
Page_Return_Code="-1"
Page_Return_Message="DOWN"
Page_Execution_Time="2222"
Page_Login_Result="Bad"
source="PowerShell/Connectivity"

Question 1)
Executing the script via splunk modular input, why do I get the opposite result? Do I need to tell the input someplace, to execute the script always on the splunk server?

Question 2)
How to I get splunk to automatically separate the 'Event' into fields?

Snippets from the PS script (server and IP values have been omitted):

Definition of the Splunk return object

$SplunkObject = [PSCustomObject]@{
host = '
Server_IP = ''
Page_Return_Code = ''
Page_Return_Message = ''
Page_Execution_Time = ''
Page_Login_Result = ''
source = "PowerShell/Connectivity"
}
.....

Return values to Splunk Event Adapter

Write-output $SplunkObject

Re: Splunk PowerShell Modula Input always returns fallback result

ansif — Mon, 11 Jun 2018 11:04:18 GMT

Where you are running this script?

Paste the whole script .

topic Re: Splunk PowerShell Modula Input always returns fallback result in Getting Data In

Splunk PowerShell Modula Input always returns fallback result

Definition of the Splunk return object

Return values to Splunk Event Adapter

Re: Splunk PowerShell Modula Input always returns fallback result