All Apps and Add-ons

Error using the Powershell-Addon (modular input)

malmiran
Path Finder

I am using the Splunk add-on for Powershell to run T-SQL files. Sample stanza below:

[powershell://GetSQLServerInfo]
script=. "$SplunkHome/etc/apps/SQLServerBase_cog-tech-database/bin/GetSQLServerInfo.ps1"
disabled = 0
schedule = * */5 * * * *
sourcetype = sql_serverinfo
index = cog-tech-database-test-nonprod

It runs perfectly. However, when I add another "powershell" stanza in the same input.conf file, I get an error. For example:

[powershell://GetSQLConfig]
script=. "$SplunkHome/etc/apps/SQLServerBase_cog-tech-database/bin/GetSQLConfig.ps1"
disabled = 0
schedule = * */5 * * * *
sourcetype = sql_config
index = cog-tech-database-test-nonprod

Error in the splunk-powershell log file:
ERROR User script exception: : An item with the same key has already been added.

I suspect, it may have something to do with loading the SQLPS module - perhaps Splunk is doing so in the same run space? It's odd because I do have a check (IF CONDITION) in my PS script before I load the SQLPS module to ensure I don't do so if it's already there (see below).

if (Get-Module -Name SQLPS -ListAvailable)
{
    if ((Get-ExecutionPolicy) -ne 'Restricted') 
    {
        Import-Module -Name SQLPS -DisableNameChecking -Verbose:$false
    }
    else
    {
        Write-Host 'The SQLPS PowerShell module cannot be loaded with an execution policy of restricted'
    }
}

Any ideas?

0 Karma
1 Solution

malmiran
Path Finder

Figured it out. It was dumb mistake in my IF. Should have used -NOT (doh!). Anyway, working now perfectly now.

View solution in original post

0 Karma

malmiran
Path Finder

Figured it out. It was dumb mistake in my IF. Should have used -NOT (doh!). Anyway, working now perfectly now.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Value Insights: Now Generally Available in the CMC

Organizations are under pressure to move faster, control cost, expand AI adoption, and prove value with more ...

What’s New in Splunk AI: Volume 02

Welcome to the second edition of “What’s New in Splunk AI” where we look at the latest and greatest updates, ...

Splunk App Dev Quarterly Roundup: AI, Agents, and Innovation!

Another quarter, another wave of innovation. From complex integrations to pushing the limits ...