All Apps and Add-ons

Error using the Powershell-Addon (modular input)

malmiran
Path Finder

I am using the Splunk add-on for Powershell to run T-SQL files. Sample stanza below:

[powershell://GetSQLServerInfo]
script=. "$SplunkHome/etc/apps/SQLServerBase_cog-tech-database/bin/GetSQLServerInfo.ps1"
disabled = 0
schedule = * */5 * * * *
sourcetype = sql_serverinfo
index = cog-tech-database-test-nonprod

It runs perfectly. However, when I add another "powershell" stanza in the same input.conf file, I get an error. For example:

[powershell://GetSQLConfig]
script=. "$SplunkHome/etc/apps/SQLServerBase_cog-tech-database/bin/GetSQLConfig.ps1"
disabled = 0
schedule = * */5 * * * *
sourcetype = sql_config
index = cog-tech-database-test-nonprod

Error in the splunk-powershell log file:
ERROR User script exception: : An item with the same key has already been added.

I suspect, it may have something to do with loading the SQLPS module - perhaps Splunk is doing so in the same run space? It's odd because I do have a check (IF CONDITION) in my PS script before I load the SQLPS module to ensure I don't do so if it's already there (see below).

if (Get-Module -Name SQLPS -ListAvailable)
{
    if ((Get-ExecutionPolicy) -ne 'Restricted') 
    {
        Import-Module -Name SQLPS -DisableNameChecking -Verbose:$false
    }
    else
    {
        Write-Host 'The SQLPS PowerShell module cannot be loaded with an execution policy of restricted'
    }
}

Any ideas?

0 Karma
1 Solution

malmiran
Path Finder

Figured it out. It was dumb mistake in my IF. Should have used -NOT (doh!). Anyway, working now perfectly now.

View solution in original post

0 Karma

malmiran
Path Finder

Figured it out. It was dumb mistake in my IF. Should have used -NOT (doh!). Anyway, working now perfectly now.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

    Thursday, June 25, 2026  |  11AM PDT / 2PM EDT  Duration: 1 Hour (Includes live Q&A) Register to ...

Analytics Workspace deprecation

As of Splunk Cloud Platform 10.4.2604 and Splunk Enterprise 10.4, Analytics Workspace is now deprecated. ...

Splunk Developer Day Recap: Building, Publishing, and Growing on the Splunk Platform

Splunk Developer Day brought the Splunk developer community together for a practical look at what it means to ...