How to create a PowerShell script to list forwarder status, then restart the service if the listing failed?

[ginger8990]

I want to find a script to list splunk forwarder status the restart the service if the listing failed.

$serverlist =
"C:\serverlist.txt"
Get-Content $serverlist |
foreach($comp in
$serverlist){Invoke-Command
-ComputerName $_ -FilePath "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"
-ArgumentList splunk list forward-server}
Or
$sstat = Get-Service -Name splunkd
#Checks for Service Status
#Restarts Splunk Service if it's running, or starts if it is stopped
if ($sstat.status -eq "running"){
    write-output "Restarting Splunk"
    restart-service splunkd
    }
elseif ($sstat.status -eq "stopped"){
    start-service splunkd
    write-output "Splunk is starting"
    }

[jkat54]

$user = "admin" 
$pass = convertto-securestring -AsPlainText -Force -String 'admin' #your password here 
$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $user,$pass 
$request = Invoke-RestMethod -uri https://localhost:8089/services/data/outputs/tcp/server -credential $cred 
$request.title

[jkat54]

Example 1:

$pinfo = New-Object System.Diagnostics.ProcessStartInfo
$pinfo.FileName = 'C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe'
$pinfo.RedirectStandardError = $true
$pinfo.RedirectStandardOutput = $true
$pinfo.UseShellExecute = $false
$pinfo.Arguments = "list forward-server"
$p = New-Object System.Diagnostics.Process
$p.StartInfo = $pinfo
$p.Start() | Out-Null
$p.WaitForExit()
$stdout = $p.StandardOutput.ReadToEnd()
$stderr = $p.StandardError.ReadToEnd()
Write-Host "stdout: $stdout"
Write-Host "stderr: $stderr"
Write-Host "exit code: " + $p.ExitCode

Example 2:
`add-type @"
using System.Net;
using System.Security.Cryptography.X509Certificates;
public class TrustAllCertsPolicy : ICertificatePolicy {
public bool CheckValidationResult(
ServicePoint srvPoint, X509Certificate certificate,
WebRequest request, int certificateProblem) {
return true;
}
}
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy

$user = "admin"
$pass = convertto-securestring -AsPlainText -Force -String 'admin' #your password here
$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $user,$pass
$request = Invoke-WebRequest -uri https://localhost:8089/services/data/outputs/tcp/default -credential $cred
$request.Content
$request = Invoke-WebRequest -uri https://localhost:8089/services/data/outputs/tcp/group -credential $cred 
$request.Content
$request = Invoke-WebRequest -uri https://localhost:8089/services/data/outputs/tcp/server -credential $cred 
$request.Content
$request = Invoke-WebRequest -uri https://localhost:8089/services/data/outputs/tcp/allconnections -credential $cred 
$request.Content`

Example 3:
http://dev.splunk.com/view/splunk-powershell-resource-kit/SP-CAAADRU

[ginger8990]

your answer is not splunk powershell related.

What you are talking about is prerequisite of using powershell...........how to you use powershell without prerequisite?

[jkat54]

Seriously... This is a loaded question. Have you ever done powershell remoting? Will you enable WinRM or use WMI? Do you know what each entails? Are you paying for the development and subsequent deployment? Or do you just expect someone to spend the next month here explaining it to you? It's hard enough to enable WinRM and double hop code execution in your own environment; let alone explain it to someone else...

[jkat54]

I share code here all the time but I don't have it in me to go into the intracacies of remote code execution in a windows environment. I'll do better by you letting you figure it out yourself anyways. I think I gave enough hints by now. Best of luck.

[ginger8990]

Splunk community is not good as spicework community, no one ever reply the Q&A.

Let me put this way: Splunk commands can support powershell? Such as splunk list forward-server is not recognized in Powershell.

[jkat54]

Hey spice works guy... I have answer and you no reply for more than 1 day. Wassup?

[piebob]

I downvoted this post because http://lmgtfy.com/?q=splunk+powershell