Getting Lync data into Splunk using the PowerShell SA

[Runals]

I'm not a powershell guy. The following scripts were passed to me to try to run with the PowerShell SA. They aren't working. I do know the system is running PowerShell 2 and that when you run the scripts locally they do work. I'm guessing there is something in the formatting that the SA doesn't like (maybe?). Open to any thoughts!

[powershell2://active_users]
script = Get-Counter –Counter "\LS:USrv - 13 - Endpoint Cache\USrv - 001 - Active Registered Endpoints" | Select-Object –ExpandProperty CounterSamples | Select-Object CookedValue
schedule = 0 0/1 * * * *
sourcetype = Active_Registered_Endpoints
source = Powershell

[powershell2://inbound_pstn_calls]
script = Get-Counter –Counter "\LS:MediationServer - 01 - Inbound Calls(*)\- 000 - Current" | Select-Object –ExpandProperty CounterSamples | Select-Object *
schedule = 0 0/1 * * * ?
sourcetype = Inbound_PSTN_Calls
source = Powershell

[ahall_splunk · Accepted solution]

So, first off - any reason you are not just using the perfmon counters here?

[perfmon://inbound-pstn-calls]
object = LS:MediationServer - 01 - Inbound Calls
counters = - 000 - Current
instances = *
interval = 60
sourcetype = Inbound_PSTN_Calls

Secondly, it looks like the schedule is slightly wrong. I know your first example IS wrong as it doesn't have a question mark in it. The second one has the question mark in the wrong place.

I'd honestly use perfmon here though.

[Runals]

That was indeed the best way to implement this and worked like a champ! Haven't played much with these so appreciate the conversion. Wish the sourcetype line worked but /shrug.