Can't seem to get PowerShell input to run

[peterfilardo]

Distributed Splunk Add-on for PowerShell 1.1 app to a few forwarders, and it doesn't seem to be running.

Here's a suspect line from splunkd.log on the forwarders:

10-22-2013 14:33:51.420 -0400 ERROR ModularInputs - Introspecting scheme=powershell: script running failed (exited with code 255).
10-22-2013 14:33:51.420 -0400 ERROR ModularInputs - Unable to initialize modular input "powershell"  defined inside the app "SA-ModularInput-PowerShell": Introspecting scheme=powershell: script running failed (exited with code 255).

Has anyone else had luck getting Splunk Add-on for PowerShell 1.1 working with 6.0?

[shreyasathavale]

I am getting same error for both powershell and powershell2 ... And execution-policy is Unrestricted. Any ideas?

[jbennett_splunk]

There are two modular inputs, "PowerShell" for all the latest versions of PowerShell, and "PowerShell2" for the older PowerShell 2. If you only see this message for PowerShell, then it just means you don't have the newer versions available.

If you're running an older server like Server 2008 R2, then it has PowerShell 2 installed by default, and that's the only version available. You could upgrade PowerShell, or just use the [PowerShell2:...] stanzas for the older version of the modular input.

[adylent]

Be sure that the powershell has the appropriate permissions to run. On the hosts with the forwarders verify the ExecutionPolicy:

Set-ExecutionPolicy remotesigned

Then you can verify with:

Get-ExecutionPolicy

[peterfilardo]

Result:
PS C:\Users\username> Get-ExecutionPolicy
RemoteSigned

Hmm, puzzling.