Powershell Add-on Error - Unauthorized Access Error

[chrismmckenna]

I want to get the AWS instance id from a collection of hosts. I figured I’d create a powershell script to make a AWS introspection call to get the instance id.

I’ve got the Splunk Add-on for Powershell (SA-ModularInput-PowerShell version 1.2.1) deployed. I’ve gone through the Powershell add-on documentation but I haven’t been able to get the Powershell script to work nor have I seen anything the directly address the errors I'm seeing in splunkd.log.

Powershell version 3 is installed.

This is getAWSInstanceId.ps1: (The output looks fine from the CLI)
Set-ExecutionPolicy unrestricted -Force
$webclient = new-object net.webclient
$instanceid = $webclient.Downloadstring('http://169.254.169.254/latest/meta-data/instance-id')
Write-Output "instanceid=$instanceid".tostring()

Do you have a simpler way to go about this? Otherwise, would you take a look at the following and possibly point out what I’m missing?

This is the inputs.conf:
[powershell://GETAWSINSTANCE]
script = . "C:\Program Files\SplunkUniversalForwarder\etc\apps\SA-ModularInput-PowerShell\bin\getAWSInstanceId.ps1"
schedule = 0 * * * * *
index=customer_hosts
sourcetype = aws:instanceid

I’m seeing the following errors in splunkd.log and nothing forwarded

12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.ps1
: File
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" C:\Program Files\SplunkUniversalForwarder\bin\splunk-powershell.ps1
cannot be
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" loaded because running scripts is disabled on this system. For more
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" information, see about_Execution_Policies at
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" http://go.microsoft.com/fwlink/?LinkID=135170.
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" At line:1 char:61
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" + & {get-content C:\Windows\TEMP\input510eb608e8b3d230.tmp |
C:\Program`
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" Files\Sp ...
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" +

12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" ~~~~~~~~~~~~~~~~~~~~
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" + CategoryInfo : SecurityError: (:) [],
PSSecurityException
12-16-2017 19:30:55.434 -0800 ERROR ExecProcessor - message from ""C:\Program
Files\SplunkUniversalForwarder\bin\splunk-powershell.exe"" + FullyQualifiedErrorId : UnauthorizedAccess

[sloshburch]

What exactly are you using that field for? It seems like something that might already be available as part of the AWS TA.

[chrismmckenna]

I kept trying different iterations and found the following works. I think the stanza name has to include Processes-<.\w+>

inputs.conf:
[powershell://Processes-getAWSInstanceId]
script = . "C:\Program Files\SplunkUniversalForwarder\etc\apps\SA-ModularInput-PowerShell\bin\getAWSInstanceId.ps1"
schedule = 0 5 1 ? * *
index=enroute_customer_hosts
sourcetype = aws:instanceid

getAWSInstanceId.ps1:
$webclient = new-object net.webclient
$instanceid = $webclient.Downloadstring('http://169.254.169.254/latest/meta-data/instance-id')
Write-Output "instanceid=$instanceid".tostring()

[chrismmckenna]

The UI is not displaying all of the asterisks, the schedule is in Quartz time and runs every minute

schedule = 0 * * * * *

[chrismmckenna]

I've also tried:
interval = 60