All Apps and Add-ons

Can't seem to get PowerShell input to run


Distributed Splunk Add-on for PowerShell 1.1 app to a few forwarders, and it doesn't seem to be running.

Here's a suspect line from splunkd.log on the forwarders:

10-22-2013 14:33:51.420 -0400 ERROR ModularInputs - Introspecting scheme=powershell: script running failed (exited with code 255).
10-22-2013 14:33:51.420 -0400 ERROR ModularInputs - Unable to initialize modular input "powershell"  defined inside the app "SA-ModularInput-PowerShell": Introspecting scheme=powershell: script running failed (exited with code 255).

Has anyone else had luck getting Splunk Add-on for PowerShell 1.1 working with 6.0?


I am getting same error for both powershell and powershell2 ... And execution-policy is Unrestricted. Any ideas?

0 Karma

Splunk Employee
Splunk Employee

There are two modular inputs, "PowerShell" for all the latest versions of PowerShell, and "PowerShell2" for the older PowerShell 2. If you only see this message for PowerShell, then it just means you don't have the newer versions available.

If you're running an older server like Server 2008 R2, then it has PowerShell 2 installed by default, and that's the only version available. You could upgrade PowerShell, or just use the [PowerShell2:...] stanzas for the older version of the modular input.

0 Karma

Path Finder

Be sure that the powershell has the appropriate permissions to run. On the hosts with the forwarders verify the ExecutionPolicy:

Set-ExecutionPolicy remotesigned

Then you can verify with:



PS C:\Users\username> Get-ExecutionPolicy

Hmm, puzzling.

0 Karma
Get Updates on the Splunk Community!

Platform Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestIntroducing Splunk Edge Processor, simplified data ...

Enterprise Security Content Updates (ESCU) - New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 3 releases of new content via the Enterprise ...

Thought Leaders are Validating Your Hard Work and Training Rigor

As a Splunk enthusiast and member of the Splunk Community, you are one of thousands who recognize the value of ...