DNS logs - INFO [:12345] Script exceeded maximum runtime of

[inventsekar]

Hi Splunk Gurus, 

I use the "Windows DNS Analytical Custom" app for DNS logs onboarding to Splunk Cloud. 

on the DC systems, the PowerShell script runs, but it does not produce any output. 

on Splunk we receive logs as "INFO [:13744] Script exceeded maximum runtime of . Terminating PID 13744"
on these logs i see the source as - source="C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe -command \"& 'c:\\Program Files\\SplunkUniversalForwarder\\etc\\apps\\TA-WinDNSAnalytical-inputs\\bin\\get_dns_analytics.ps1'\" -SplunkdLogging"

one thing to note - the DC systems are pretty busy systems. maybe the script runs but timeouts(i believe). so working on increasing the "timeout" parameter in the inputs.conf file. 

any other suggestions, thoughts pls, thanks. 

[inventsekar · Accepted solution]

We worked with Splunk Support and they suggested some editings/updates on that powershell script, which resolved this issue, hence solving this questions. thanks. 

thanks @PrewinThomas .. given upvotes, thanks again. 

[PrewinThomas]

@inventsekar 

On busy DCs script can take longer than the default timeout to query.

Can you run the powershell directly and see how long its taking and adjust your timeout accordingly.

& 'C:\Program Files\SplunkUniversalForwarder\etc\apps\TA-WinDNSAnalytical-inputs\bin\get_dns_analytics.ps1'

Regards,
Prewin
If this answer helped you, please consider marking it as the solution or giving a Karma. Thanks!