Getting Data In

How to import text file results of a powershell script when app is opened?

slashnburn
Path Finder

I have a powershell script that outputs a text file. What I want to do is have that powershell script run once a day and splunk to ingest the text file that has been generated by that powershell script whenever my app is opened. What is the most efficient way to do this?

I have toyed with a couple different ideas:

  • Put the powershell script on the forwarder, configuring it to run once a day, and configure splunk to monitor the directory where that file is output
  • Configure splunk to monitor a batch file that runs the powershell script (I don't think this will actually grab the text file that is generated)
0 Karma
1 Solution

slashnburn
Path Finder

As on my other post relating to this issue, there is a process for using scripts. The best way I found was to place them in the splunk bin, rather than the app bin. I decided to just take the stdout from the script, rather than use the text file. With that said, if you still wanted to use the text file, follow the procedure for running the script that outputs the file, then have splunk monitor the output file.

View solution in original post

0 Karma

slashnburn
Path Finder

As on my other post relating to this issue, there is a process for using scripts. The best way I found was to place them in the splunk bin, rather than the app bin. I decided to just take the stdout from the script, rather than use the text file. With that said, if you still wanted to use the text file, follow the procedure for running the script that outputs the file, then have splunk monitor the output file.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Persistent Queue at TcpOut — One of Splunk's Most Practical Features

Splunk introduced persistent queueing at the tcpout layer as one of the most practical resilience features in ...

Skip the Awkward Silence: Have a .conf-ersation at .conf26

Picture this. You arrive at .conf26 already having your socializing and networking plans mapped out. No ...

Rethinking Zero Trust: From Product Purchases to Logical Control Evidence

Implementing Zero Trust (ZT) across complex environments often falters at the very beginning due to a ...