All Apps and Add-ons

Error using the Powershell-Addon (modular input)

malmiran
Path Finder

I am using the Splunk add-on for Powershell to run T-SQL files. Sample stanza below:

[powershell://GetSQLServerInfo]
script=. "$SplunkHome/etc/apps/SQLServerBase_cog-tech-database/bin/GetSQLServerInfo.ps1"
disabled = 0
schedule = * */5 * * * *
sourcetype = sql_serverinfo
index = cog-tech-database-test-nonprod

It runs perfectly. However, when I add another "powershell" stanza in the same input.conf file, I get an error. For example:

[powershell://GetSQLConfig]
script=. "$SplunkHome/etc/apps/SQLServerBase_cog-tech-database/bin/GetSQLConfig.ps1"
disabled = 0
schedule = * */5 * * * *
sourcetype = sql_config
index = cog-tech-database-test-nonprod

Error in the splunk-powershell log file:
ERROR User script exception: : An item with the same key has already been added.

I suspect, it may have something to do with loading the SQLPS module - perhaps Splunk is doing so in the same run space? It's odd because I do have a check (IF CONDITION) in my PS script before I load the SQLPS module to ensure I don't do so if it's already there (see below).

if (Get-Module -Name SQLPS -ListAvailable)
{
    if ((Get-ExecutionPolicy) -ne 'Restricted') 
    {
        Import-Module -Name SQLPS -DisableNameChecking -Verbose:$false
    }
    else
    {
        Write-Host 'The SQLPS PowerShell module cannot be loaded with an execution policy of restricted'
    }
}

Any ideas?

0 Karma
1 Solution

malmiran
Path Finder

Figured it out. It was dumb mistake in my IF. Should have used -NOT (doh!). Anyway, working now perfectly now.

View solution in original post

0 Karma

malmiran
Path Finder

Figured it out. It was dumb mistake in my IF. Should have used -NOT (doh!). Anyway, working now perfectly now.

0 Karma
Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Dynamic formatting from XML events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...