I want to get the AWS instance id from a collection of hosts. I figured I’d create a powershell script to make a AWS introspection call to get the instance id.
I’ve got the Splunk Add-on for Powershell (SA-ModularInput-PowerShell version 1.2.1) deployed. I’ve gone through the Powershell add-on documentation but I haven’t been able to get the Powershell script to work nor have I seen anything the directly address the errors I'm seeing in splunkd.log.
Powershell version 3 is installed.
This is getAWSInstanceId.ps1: (The output looks fine from the CLI)
Set-ExecutionPolicy unrestricted -Force
$webclient = new-object net.webclient
$instanceid = $webclient.Downloadstring('http://169.254.169.254/latest/meta-data/instance-id')
Write-Output "instanceid=$instanceid".tostring()
Do you have a simpler way to go about this? Otherwise, would you take a look at the following and possibly point out what I’m missing?
This is the inputs.conf:
[powershell://GETAWSINSTANCE]
script = . "C:\Program Files\SplunkUniversalForwarder\etc\apps\SA-ModularInput-PowerShell\bin\getAWSInstanceId.ps1"
schedule = 0 * * * * *
index=customer_hosts
sourcetype = aws:instanceid
I’m seeing the following errors in splunkd.log and nothing forwarded
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.ps1
: File
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.ps1
cannot be
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" loaded because running scripts is disabled on this system. For more
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" information, see about_Execution_Policies at
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" http://go.microsoft.com/fwlink/?LinkID=135170.
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" At line:1 char:61
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" + & {get-content C:\Windows\TEMP\input510eb608e8b3d230.tmp |
C:\Program`
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" Files\Sp ...
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" +
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" ~~~~~~~~~~~~~~~~~~~~
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" + CategoryInfo : SecurityError: (:) [],
PSSecurityException
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" + FullyQualifiedErrorId : UnauthorizedAccess
What exactly are you using that field for? It seems like something that might already be available as part of the AWS TA.
I kept trying different iterations and found the following works. I think the stanza name has to include Processes-<.\w+>
inputs.conf:
[powershell://Processes-getAWSInstanceId]
script = . "C:\Program Files\SplunkUniversalForwarder\etc\apps\SA-ModularInput-PowerShell\bin\getAWSInstanceId.ps1"
schedule = 0 5 1 ? * *
index=enroute_customer_hosts
sourcetype = aws:instanceid
getAWSInstanceId.ps1:
$webclient = new-object net.webclient
$instanceid = $webclient.Downloadstring('http://169.254.169.254/latest/meta-data/instance-id')
Write-Output "instanceid=$instanceid".tostring()
The UI is not displaying all of the asterisks, the schedule is in Quartz time and runs every minute
schedule = 0 * * * * *
I've also tried:
interval = 60