topic Re: How can I get a PowerShell script to run at startup and every day thereafter? in Getting Data In

How can I get a PowerShell script to run at startup and every day thereafter?

54638 — Thu, 19 Sep 2019 17:55:17 GMT

How can I set a PowerShell script to run on startup and every 24 hours thereafter on a UF? I have tried using interval and schedule. Most of my UFs are 7.1.4 but there are some older 6.6 UFs floating around.

If I only use interval, it will run at startup, but not at any interval.
If I only use schedule, it will run on the schedule, either using time in seconds or cron, but not at startup.
If I use interval and schedule, it will only follow the schedule parameter.

[powershell://LocalAdministrators]
disabled = 0
script = & "$SplunkHome\etc\apps\win_scripts\bin\LocalAdministrators.ps1"
interval = 86400
schedule = 86400

Re: How can I get a PowerShell script to run at startup and every day thereafter?

jhornsby_splunk — Fri, 20 Sep 2019 12:33:34 GMT

Hi,

interval does not work for specific powershell stanzas. You can set it for the modular input as a whole like so:

[powershell]
interval = 60

But that just specifies how frequently Splunk tries to run splunk-powershell.exe, just as with all the other Windows modular inputs (and like a lot of the other modular inputs, if there are any specific stanzas defined, then the modular input executable will run continuously, and only be restarted if it crashes, say).

In terms of what you'd like to achieve, it is possible, albeit in a slightly hacky way. What you basically need to do is to use two stanzas; e.g.:

[powershell://LocalAdministrators-AtStart]
script = & "$SplunkHome\etc\apps\win_scripts\bin\LocalAdministrators.ps1"

[powershell://LocalAdministrators-EveryDay]
script = & "$SplunkHome\etc\apps\win_scripts\bin\LocalAdministrators.ps1"
schedule = 86400

(Not specifying schedule means that the script is only run once.)

Hope this helps!

Cheers,

- Jo.

Re: How can I get a PowerShell script to run at startup and every day thereafter?

54638 — Fri, 20 Sep 2019 13:37:21 GMT

"Hacky" solution it is, since it appears to meet my needs in my testing.

Thanks for the information on interval. I started trying use that because Splunk Support told me to...

Re: How can I get a PowerShell script to run at startup and every day thereafter?

jhornsby_splunk — Fri, 20 Sep 2019 13:43:47 GMT

Great! Glad to hear it worked for you! &:)