Splunk for Microsoft Exchange App get-databasestats.ps1 Error

[imarks004]

Has anyone seen the below error with the fwd_exchange2007_store \bin\get-databasestats.ps1 powershell script? I see this on all for mailbox servers(2active/2passive). I am troubleshooting why some events are not populating back into my indexers and this looked like a good place to start. It seems like most of my Exchange data is populating correctly with just a few exceptions that I am trying to clean up.


09-02-2011 14:20:00.480 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\fwd_exchange2007_store\bin\exchangepowershell.cmd" get-databasestats.ps1" The operation '[System.UInt64] / [System.UInt64]' is not defined.
09-02-2011 14:20:00.480 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\fwd_exchange2007_store\bin\exchangepowershell.cmd" get-databasestats.ps1" At C:\Program Files\SplunkUniversalForwarder\etc\apps\fwd_exchange2007_store\bi
09-02-2011 14:20:00.480 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\fwd_exchange2007_store\bin\exchangepowershell.cmd" get-databasestats.ps1" n\powershell\get-databasestats.ps1:32 char:45
09-02-2011 14:20:00.480 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\fwd_exchange2007_store\bin\exchangepowershell.cmd" get-databasestats.ps1" + $EdbDriveFree = ($EdbDriveInfo.FreeSpace / <<<< $EdbDriveInfo.Size)
09-02-2011 14:20:00.480 -0400 ERROR ExecProcessor - message from ""C:\Program Files\SplunkUniversalForwarder\etc\apps\fwd_exchange2007_store\bin\exchangepowershell.cmd" get-databasestats.ps1" * 100.00


[donwant · Accepted solution]

There is a bug with Powershell v1 apparently. If you edit the databasestats and cast one or both of the variables to a long it will work.
To cast it to a long just put [long] in front of the variable.

I can't find the reference I used to fix this yesterday now so I can't give proper credit unfortunately.
Correction: finally found the reference!
http://www.techtalkz.com/microsoft-windows-powershell/466362-completely-easy-question-division.html

[imarks004]

Thanks, adding the [long] in front of the variables fixed this issue.

[ahall_splunk]

Can you possibly contact me at msexchange@splunk.com so I can incorporate this into the next release?

[ahall_splunk]

The key part here is that the [System.UInt64] / [ System.UInt64] is not defined. This is a core feature of Powershell, so it's likely that there is a problem with your Powershell implementation. To diagnose further, you can run this outside of the Splunk system to see what the error is. To do this, run the get-databasestats.ps1 at a powershell command prompt. It should run to completion without errors.