All Apps and Add-ons

How to create a PowerShell script to list forwarder status, then restart the service if the listing failed?

Explorer

I want to find a script to list splunk forwarder status the restart the service if the listing failed.

$serverlist =
"C:\serverlist.txt"
Get-Content $serverlist |
foreach($comp in
$serverlist){Invoke-Command
-ComputerName $_ -FilePath "C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe"
-ArgumentList splunk list forward-server}
Or
$sstat = Get-Service -Name splunkd
#Checks for Service Status
#Restarts Splunk Service if it's running, or starts if it is stopped
if ($sstat.status -eq "running"){
    write-output "Restarting Splunk"
    restart-service splunkd
    }
elseif ($sstat.status -eq "stopped"){
    start-service splunkd
    write-output "Splunk is starting"
    }
0 Karma

SplunkTrust
SplunkTrust
$user = "admin" 
$pass = convertto-securestring -AsPlainText -Force -String 'admin' #your password here 
$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $user,$pass 
$request = Invoke-RestMethod -uri https://localhost:8089/services/data/outputs/tcp/server -credential $cred 
$request.title
0 Karma

SplunkTrust
SplunkTrust

Example 1:

$pinfo = New-Object System.Diagnostics.ProcessStartInfo
$pinfo.FileName = 'C:\Program Files\SplunkUniversalForwarder\bin\splunk.exe'
$pinfo.RedirectStandardError = $true
$pinfo.RedirectStandardOutput = $true
$pinfo.UseShellExecute = $false
$pinfo.Arguments = "list forward-server"
$p = New-Object System.Diagnostics.Process
$p.StartInfo = $pinfo
$p.Start() | Out-Null
$p.WaitForExit()
$stdout = $p.StandardOutput.ReadToEnd()
$stderr = $p.StandardError.ReadToEnd()
Write-Host "stdout: $stdout"
Write-Host "stderr: $stderr"
Write-Host "exit code: " + $p.ExitCode

Example 2:
`add-type @"
using System.Net;
using System.Security.Cryptography.X509Certificates;
public class TrustAllCertsPolicy : ICertificatePolicy {
public bool CheckValidationResult(
ServicePoint srvPoint, X509Certificate certificate,
WebRequest request, int certificateProblem) {
return true;
}
}
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertsPolicy

$user = "admin"
$pass = convertto-securestring -AsPlainText -Force -String 'admin' #your password here
$cred = new-object -typename System.Management.Automation.PSCredential -argumentlist $user,$pass
$request = Invoke-WebRequest -uri https://localhost:8089/services/data/outputs/tcp/default -credential $cred
$request.Content
$request = Invoke-WebRequest -uri https://localhost:8089/services/data/outputs/tcp/group -credential $cred 
$request.Content
$request = Invoke-WebRequest -uri https://localhost:8089/services/data/outputs/tcp/server -credential $cred 
$request.Content
$request = Invoke-WebRequest -uri https://localhost:8089/services/data/outputs/tcp/allconnections -credential $cred 
$request.Content`

Example 3:
http://dev.splunk.com/view/splunk-powershell-resource-kit/SP-CAAADRU

0 Karma

Explorer

your answer is not splunk powershell related.

What you are talking about is prerequisite of using powershell...........how to you use powershell without prerequisite?

0 Karma

SplunkTrust
SplunkTrust

Seriously... This is a loaded question. Have you ever done powershell remoting? Will you enable WinRM or use WMI? Do you know what each entails? Are you paying for the development and subsequent deployment? Or do you just expect someone to spend the next month here explaining it to you? It's hard enough to enable WinRM and double hop code execution in your own environment; let alone explain it to someone else...

SplunkTrust
SplunkTrust

I share code here all the time but I don't have it in me to go into the intracacies of remote code execution in a windows environment. I'll do better by you letting you figure it out yourself anyways. I think I gave enough hints by now. Best of luck.

0 Karma

Explorer

Splunk community is not good as spicework community, no one ever reply the Q&A.

Let me put this way: Splunk commands can support powershell? Such as splunk list forward-server is not recognized in Powershell.

0 Karma

SplunkTrust
SplunkTrust

Hey spice works guy... I have answer and you no reply for more than 1 day. Wassup?

0 Karma

Motivator

I downvoted this post because http://lmgtfy.com/?q=splunk+powershell

State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!