topic Re: Two Nearly Identical Inputs But One Doesnt Work (PowerShell) in Splunk Search

Two Nearly Identical Inputs But One Doesnt Work (PowerShell)

JordanPeterson — Tue, 08 May 2018 00:02:37 GMT

So I have the two below in my inputs.conf the top one works, the bottom one does not. Both commands work fine when ran on the machines the forwarders are on. I cannot find any differences that I could be missing. Thoughts?

[powershell://Get-ClusterGroup]
script = Get-ClusterGroup | Select Name,OwnerNode,State
schedule = 0 */5 * * *
index = pod-db
disabled = 0
sourcetype = Get-ClusterGroup

[powershell://Get-ClusterNode]
script = Get-ClusterNode | Select Name,ID,State
schedule = 0 */5 * * *
index = pod-db
disabled = 0
sourcetype = Get-ClusterNode

In fact I know they are identical because I did a yank and put in vim to duplicate the top one that works. There is nothing unusual in the splunk-powershell.ps1.log file on the forwarder machine.

Re: Two Nearly Identical Inputs But One Doesnt Work (PowerShell)

jconger — Tue, 08 May 2018 00:08:42 GMT

When you say the top one works but the bottom one doesn't, are you just not seeing data for the sourcetype in the pod-db index? Or, do you see some type of error?

Nothing jumps out as wrong in your inputs.conf though. Maybe some setting somewhere else is interfering? My personal next step would be btool to check the expanded inputs.conf -> https://docs.splunk.com/Documentation/Splunk/7.1.0/Troubleshooting/Usebtooltotroubleshootconfigurations

Something like the following:

./splunk cmd btool inputs list --debug

Re: Two Nearly Identical Inputs But One Doesnt Work (PowerShell)

JordanPeterson — Tue, 08 May 2018 00:21:17 GMT

I'm seeing data for one but not the other. No errors I can find. Here's the btool results from that section. Still looks nearly identical. cwdbsql011-01 is the forwarder machine.

D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  [powershell://Get-ClusterGroup]
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  disabled = 0
host = cwdbsql011-01
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  index = pod-db
D:\Program Files\Splunk\etc\system\default\inputs.conf                             interval = 60
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  schedule = 0 */5 * * *
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  script = Get-ClusterGroup | Select Name,OwnerNode,State
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  sourcetype = Get-ClusterGroup
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  [powershell://Get-ClusterNode]
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  disabled = 0
host = cwdbsql011-01
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  index = pod-db
D:\Program Files\Splunk\etc\system\default\inputs.conf                             interval = 60
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  schedule = 0 */5 * * *
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  script = Get-ClusterNode | Select Name,ID,State
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  sourcetype = Get-ClusterNode

Re: Two Nearly Identical Inputs But One Doesnt Work (PowerShell)

JordanPeterson — Tue, 08 May 2018 00:46:48 GMT

Alright, not sure why this worked buy I dropped the "Get-" from Get-ClusterNode in the source and sourcetype and it works. I'm not sure why that's the case but apparently it is.