All Apps and Add-ons

Getting Lync data into Splunk using the PowerShell SA

Runals
Motivator

I'm not a powershell guy. The following scripts were passed to me to try to run with the PowerShell SA. They aren't working. I do know the system is running PowerShell 2 and that when you run the scripts locally they do work. I'm guessing there is something in the formatting that the SA doesn't like (maybe?). Open to any thoughts!

[powershell2://active_users]
script = Get-Counter –Counter "\LS:USrv - 13 - Endpoint Cache\USrv - 001 - Active Registered Endpoints" | Select-Object –ExpandProperty CounterSamples | Select-Object CookedValue
schedule = 0 0/1 * * * *
sourcetype = Active_Registered_Endpoints
source = Powershell

[powershell2://inbound_pstn_calls]
script = Get-Counter –Counter "\LS:MediationServer - 01 - Inbound Calls(*)\- 000 - Current" | Select-Object –ExpandProperty CounterSamples | Select-Object *
schedule = 0 0/1 * * * ?
sourcetype = Inbound_PSTN_Calls
source = Powershell
0 Karma
1 Solution

ahall_splunk
Splunk Employee
Splunk Employee

So, first off - any reason you are not just using the perfmon counters here?

[perfmon://inbound-pstn-calls]
object = LS:MediationServer - 01 - Inbound Calls
counters = - 000 - Current
instances = *
interval = 60
sourcetype = Inbound_PSTN_Calls

Secondly, it looks like the schedule is slightly wrong. I know your first example IS wrong as it doesn't have a question mark in it. The second one has the question mark in the wrong place.

I'd honestly use perfmon here though.

View solution in original post

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

So, first off - any reason you are not just using the perfmon counters here?

[perfmon://inbound-pstn-calls]
object = LS:MediationServer - 01 - Inbound Calls
counters = - 000 - Current
instances = *
interval = 60
sourcetype = Inbound_PSTN_Calls

Secondly, it looks like the schedule is slightly wrong. I know your first example IS wrong as it doesn't have a question mark in it. The second one has the question mark in the wrong place.

I'd honestly use perfmon here though.

0 Karma

Runals
Motivator

That was indeed the best way to implement this and worked like a champ! Haven't played much with these so appreciate the conversion. Wish the sourcetype line worked but /shrug.

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...

Major Splunk Upgrade – Prepare your Environment for Splunk 10 Now!

Attention App Developers: Test Your Apps with the Splunk 10.0 Beta and Ensure Compatibility Before the ...

Stay Connected: Your Guide to June Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...