Script:InstalledApps Not properly breaking into events from some hosts

[agodoy]

I am running the Windows-TA and I enabled the Script:InstalledApps input.

For the most part the script is working with no problems across my forwarders. However, for some hosts all the apps enumerated from the registry show up as one event.

Any ideas on how to chase this one down? Is the issue at the forwarder, indexer, or search head?

[my2ndhead]

Ok. The Splunk_TA_windows is buggy.

This is a quick fix:

On the indexer (or where the parsing queue resides) add this to $SPLUNK_HOME/etc/apps/Splunk_TA_windows/local/props.conf:

[Script:InstalledApps]
SHOULD_LINEMERGE = true
LINE_BREAKER =

Note: Empty string behind LINE_BREAKER is ok

In $SPLUNK_HOME/etc/deployment-apps/Splunk_TA_windows/local/props.conf add:

[script://.\bin\win_installed_apps.bat]
disabled = 0
sourcetype = Script:InstalledApps

[jamesklassen]

I did fix this problem. It's been awhile and I can't quite remember what I did, but I believe I rewrote the powershell script that gathers the data. I can't tell you what I changed, but this is what's now working for me:

Get list of installed software, for both 32 and 64bit applications

$OutputEncoding = [Text.Encoding]::UTF8
$Date = Get-Date -format 'yyyy-MM-ddTHH:mm:sszzz'
$serverName = $env:computername

add 32bit applications to output

foreach($app in (Get-ItemProperty HKLM:\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall* | where-object{$_.DisplayName -ne $null})){
$Output = New-Object System.Collections.ArrayList
[void]$Output.Add($Date)
[void]$Output.Add("HostName="$serverName"")
[void]$Output.Add("DisplayName="$($app.DisplayName)"")
[void]$Output.Add("DisplayVersion="$($app.DisplayVersion)"")

[void]$Output.Add("Publisher="$($app.Publisher)"")

[void]$Output.Add("InstallDate="$($app.InstallDate)"")

[void]$Output.Add("InstallSource="$($app.InstallSource)"")
Write-Host ($Output -join " ")
}

add 64bit applications to output

foreach($app in (Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall* | where-object{$_.DisplayName -ne $null})){
$Output = New-Object System.Collections.ArrayList
[void]$Output.Add($Date)
[void]$Output.Add("HostName="$serverName"")
[void]$Output.Add("DisplayName="$($app.DisplayName)"")
[void]$Output.Add("DisplayVersion="$($app.DisplayVersion)"")

[void]$Output.Add("Publisher="$($app.Publisher)"")

[void]$Output.Add("InstallDate="$($app.InstallDate)"")

[void]$Output.Add("InstallSource="$($app.InstallSource)"")
Write-Host ($Output -join " ")
}

[systemsatpayzon]

I am also having this problem, is there a solution for it available?

[jamesklassen]

I'm also having this problem. Did you find a solution?