topic Re: SA modular input powershell is directing data to default main indexer? in Getting Data In

SA modular input powershell is directing data to default main indexer?

rjvydla — Tue, 29 Sep 2020 19:32:20 GMT

Hi All,
i tried using SA_modular_input_powershell app and i gave windows index in inputs.conf as index = windows.
when i didn't gave any index, the data is going to default main index. But when i gave index = windows or something the data is not getting generated.
what might be the reason.

ex:
[powershell://DriverInfo]
script = . "C:/Program Files/SplunkUniversalForwarder/etc/apps/SA-ModularInput-PowerShell/bin/DriverVersion.ps1"
interval = 14400

index = windows
sourcetype = Powershell

Thank you.

Re: SA modular input powershell is directing data to default main indexer?

xpac — Tue, 15 May 2018 13:11:08 GMT

Most likely reason - the index you entered hasn't been created before.

Hope that helps - if it does I'd be happy if you would upvote/accept this answer, so others could profit from it. 🙂

Re: SA modular input powershell is directing data to default main indexer?

rjvydla — Tue, 15 May 2018 15:22:12 GMT

i have been using the index i gave for other normal apps. it was woriking there but not in this app.