topic Re: Why can't Splunk continuously index data from a powershell input? in Getting Data In

Why can't Splunk continuously index data from a powershell input?

yutaka1005 — Thu, 10 Jan 2019 06:19:01 GMT

Splunk ver : 6.6.6
OS : Linux 7

Universal Forwarder ver : 6.6.6
OS : Windows Server 2016

I configured below inputs.conf and sample.ps1 in the Universal Forwarder and Splunk indexed once, but after that, no more events were indexed.

inputs.conf

[powershell://power_shell_sapmle]
script = . "$SplunkHome\etc\apps\sample_app\bin\sample.ps1"
interval = */1 * * * *
sourcetype = power_shell_sapmle

sample.ps1

$Output = invoke-expression "wmic cpu list brief"
Write-Output $Output

Is my configuration wrong?

Please someone help me.

deepashri_123 — Thu, 10 Jan 2019 08:43:32 GMT

Hey@yutaka1005,

As per the docs, default the script executes only once.
To schedule the script, you can try using parameter

schedule=<cron>

Let me know if this helps!!

yutaka1005 — Fri, 11 Jan 2019 02:47:57 GMT

Thank you for answer!

I did not check the manual properly ...
It was very helpful.