How can I get a PowerShell script to run at startup and every day thereafter?

[54638]

How can I set a PowerShell script to run on startup and every 24 hours thereafter on a UF? I have tried using interval and schedule. Most of my UFs are 7.1.4 but there are some older 6.6 UFs floating around.

If I only use interval, it will run at startup, but not at any interval.
If I only use schedule, it will run on the schedule, either using time in seconds or cron, but not at startup.
If I use interval and schedule, it will only follow the schedule parameter.

[powershell://LocalAdministrators]
disabled = 0
script = & "$SplunkHome\etc\apps\win_scripts\bin\LocalAdministrators.ps1"
interval = 86400
schedule = 86400

[jhornsby_splunk · Accepted solution]

Hi,

interval does not work for specific powershell stanzas. You can set it for the modular input as a whole like so:

[powershell]
interval = 60

But that just specifies how frequently Splunk tries to run splunk-powershell.exe, just as with all the other Windows modular inputs (and like a lot of the other modular inputs, if there are any specific stanzas defined, then the modular input executable will run continuously, and only be restarted if it crashes, say).

In terms of what you'd like to achieve, it is possible, albeit in a slightly hacky way. What you basically need to do is to use two stanzas; e.g.:

[powershell://LocalAdministrators-AtStart]
script = & "$SplunkHome\etc\apps\win_scripts\bin\LocalAdministrators.ps1"

[powershell://LocalAdministrators-EveryDay]
script = & "$SplunkHome\etc\apps\win_scripts\bin\LocalAdministrators.ps1"
schedule = 86400

(Not specifying schedule means that the script is only run once.)

Hope this helps!

Cheers,

- Jo.

[54638]

"Hacky" solution it is, since it appears to meet my needs in my testing.

Thanks for the information on interval. I started trying use that because Splunk Support told me to...

[jhornsby_splunk]

Great! Glad to hear it worked for you! &:)