All Apps and Add-ons

Getting Lync data into Splunk using the PowerShell SA

Runals
Motivator

I'm not a powershell guy. The following scripts were passed to me to try to run with the PowerShell SA. They aren't working. I do know the system is running PowerShell 2 and that when you run the scripts locally they do work. I'm guessing there is something in the formatting that the SA doesn't like (maybe?). Open to any thoughts!

[powershell2://active_users]
script = Get-Counter –Counter "\LS:USrv - 13 - Endpoint Cache\USrv - 001 - Active Registered Endpoints" | Select-Object –ExpandProperty CounterSamples | Select-Object CookedValue
schedule = 0 0/1 * * * *
sourcetype = Active_Registered_Endpoints
source = Powershell

[powershell2://inbound_pstn_calls]
script = Get-Counter –Counter "\LS:MediationServer - 01 - Inbound Calls(*)\- 000 - Current" | Select-Object –ExpandProperty CounterSamples | Select-Object *
schedule = 0 0/1 * * * ?
sourcetype = Inbound_PSTN_Calls
source = Powershell
0 Karma
1 Solution

ahall_splunk
Splunk Employee
Splunk Employee

So, first off - any reason you are not just using the perfmon counters here?

[perfmon://inbound-pstn-calls]
object = LS:MediationServer - 01 - Inbound Calls
counters = - 000 - Current
instances = *
interval = 60
sourcetype = Inbound_PSTN_Calls

Secondly, it looks like the schedule is slightly wrong. I know your first example IS wrong as it doesn't have a question mark in it. The second one has the question mark in the wrong place.

I'd honestly use perfmon here though.

View solution in original post

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

So, first off - any reason you are not just using the perfmon counters here?

[perfmon://inbound-pstn-calls]
object = LS:MediationServer - 01 - Inbound Calls
counters = - 000 - Current
instances = *
interval = 60
sourcetype = Inbound_PSTN_Calls

Secondly, it looks like the schedule is slightly wrong. I know your first example IS wrong as it doesn't have a question mark in it. The second one has the question mark in the wrong place.

I'd honestly use perfmon here though.

0 Karma

Runals
Motivator

That was indeed the best way to implement this and worked like a champ! Haven't played much with these so appreciate the conversion. Wish the sourcetype line worked but /shrug.

0 Karma
Get Updates on the Splunk Community!

Index This | What did the zero say to the eight?

June 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

Splunk Observability Cloud's AI Assistant in Action Series: Onboarding New Hires & ...

This is the fifth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Now Playing: Splunk Education Summer Learning Premieres

It’s premiere season, and Splunk Education is rolling out new releases you won’t want to miss. Whether you’re ...