How to separate PowerShell objects with / for search?

[pamkkkkk]

Hi!

I have written a PowerShell Script to obtain Hard-Disk Informations for Local Drives and report it to Splunk.

If(Get-Command -Name 'Get-CimInstance' -ErrorAction SilentlyContinue) {
    $Drives = Get-CimInstance -Query 'SELECT * FROM Win32_LogicalDisk WHERE DriveType=3' -QueryDialect 'WQL'
} Else {
    $Drives = Get-WmiObject -Query 'SELECT * FROM Win32_LogicalDisk WHERE DriveType=3'
}

$Drives | ForEach-Object {
    $Drive = $_ | Select-Object FreeSpace,Size,FileSystem,VolumeSerialNumber,PercentFree,UsedGB,FreeGB,@{Name='DriveLetter';Expression={ $_.DeviceID }},IsSystemdrive
    $Drive.PercentFree = [Math]::Round(($Drive.FreeSpace / $Drive.Size * 100),2)
    $Drive.UsedGB = [Math]::Round((($Drive.Size - $Drive.FreeSpace) / 1GB),2) 
    $Drive.FreeGB = [Math]::Round(($Drive.FreeSpace / 1GB),2)
    If($Drive.DriveLetter -eq $env:SystemDrive) {
        $Drive.IsSystemdrive = $true
    } Else {
        $Drive.IsSystemdrive = $false
    }
    $Drive
}

This gives me  the following result in Splunk for a System  with Harddisk C and D 

FreeSpace          : 37910388835
Size               : 106847793152
FileSystem         : NTFS
VolumeSerialNumber : 64A9A098
PercentFree        : 53,54
UsedGB             : 46,23
FreeGB             : 53,28
DriveLetter        : C:
IsSystemdrive      : True
FreeSpace          : 27610488832
Size               : 268432306176
FileSystem         : NTFS
VolumeSerialNumber : E2651A32
PercentFree        : 10,29
UsedGB             : 224,28
FreeGB             : 25,71
DriveLetter        : D:
IsSystemdrive      : False

My Query skills are not the best ... 😞

How can I separate the PowerShell objects (Disk C: and D:) in a query?
For example; To monitor the system drive only?

This discussion is for learning, how to parse such PowerShell objects.
Not to use other workarounds.)

I'm also grateful if someone has tips on how to better prepare (separate) the PowerShell objects for Splunk searches.

[javiergn]

Hi @pamkkkkk , you could also try the following:

| rex max_match=0 "(?msi)(?<raw>FreeSpace.+?IsSystemdrive\s+:\s+\w+)\s*"
| fields - _raw | mvexpand raw
| rex field=raw mode=sed "s/ //g"
| rex field=raw mode=sed "s/\n/ /g"
| rename raw as _raw
| extract pairdelim=" " kvdelim=":"

This is how I tested it and the output:

If you write your PS output already in key=value pairs (or key:value, or any other delimiter) it'll be easier to extract than multiline and a lot cheaper from a performance point of view.

Regards,

J

[ITWhisperer]

You could try something like this

| rex max_match=0 "(?<name>\w+)\s+:\s(?<value>.+)"
| streamstats count as event
| eval count=mvcount(name)
| eval row=mvrange(0,count)
| mvexpand row
| eval name=mvindex(name,row)
| eval value=mvindex(value,row)
| eval {name}=value
| fields - name value _raw row count
| stats list(*) as * by event
| eval drive=mvcount(DriveLetter)
| eval row=mvrange(0,drive)
| mvexpand row
| rename row as _row
| rename event as _event
| foreach *
    [| eval <<FIELD>>=mvindex(<<FIELD>>,_row)]
| rename _event as event

[pamkkkkk]

Hi ITWhisperer,

Thank you for your help.

Such a complicated query monster? I hoped for an easy to understand solution.
I think the parsing cost for such a query are very high on Server or not?

I give it a try....