topic Re: Is there a way to run a PowerShell script locally from Splunk? in Getting Data In

Is there a way to run a PowerShell script locally from Splunk?

SplunkIsLife — Fri, 28 Sep 2018 17:39:23 GMT

I'm trying to hit an API with a PowerShell command through Splunk without needing to ingest the logs on a regular cadence (and setting up a VM to forward the logs, etc). Is there a way to do this with a command similar to the |jira command?

Re: Is there a way to run a PowerShell script locally from Splunk?

JDukeSplunk — Fri, 28 Sep 2018 17:54:01 GMT

I don't see why not.

We have some powershell scripts that we just kick off by way of a batch file. So get a working batch file that runs your powershell the way you would expect, then put the batch file in Splunk at whatever internval/sourcetype whatever you like in Settings>>Data inputs>>Scripts.

Or maybe under
Powershell v3 Modular Input
Settings>>Data inputs » Powershell v3 Modular Input.

Re: Is there a way to run a PowerShell script locally from Splunk?

SplunkIsLife — Fri, 28 Sep 2018 18:38:21 GMT

Wouldn't this ingest it though? I'm trying to not ingest logs at a regular cadence, just call an API and read logs in on a one-off basis without having them live on an indexer

Re: Is there a way to run a PowerShell script locally from Splunk?

JDukeSplunk — Tue, 02 Oct 2018 17:21:35 GMT

Maybe, maybe not. If your powershell/batch executes and writes out to a text/log file but does not echo it to console then Splunk will ingest the command, and the output of the command. @echo off?

Something like..

DATE C:\Somefolder\somefile.bat
DATE C:\Somefolder\somefile.ps1

and that should be it.

You can then tell the file monitor portion of Splunk to read the output file log if you so choose.
If the scripts output verbosely to the console then Splunk will probably pick that up.

I've not done Windows batch in a while or powershell scripting much at all, but I think you would want your file to do the Linux equivalent of >dev null if you don't want Splunk to pickup the actual script output.