I've set up a new scripted input using powershell as follows:
[script://$SPLUNK_HOME\bin\scripts\RESENDREQUEST.path] source = RESENDREQUESTLOG sourcetype = RESENDREQUESTLOG interval = 10 disabled = 0
Created RESENDREQUEST.path in $SPLUNK_HOME\bin\scripts:
%SystemRoot%\System32\WindowsPowerShell\v1.0\powershell.exe -file "C:\Program Files\SplunkUniversalForwarder\bin\scripts\RESENDREQUEST.ps1"
Now, powershell isn't being run and I see no errors in the splunkd.log file.
You can use some tools such as
psexec.exe to run the same powershell command as the user splunk is running as to see what happens.
You may be running into an issue related to the execution policy of the machine you're on. See
psexec are console apps, so you can execute them at command prompt. Open a command prompt with administrative rights on the Universal Forwarder and try the following:
If splunk is running as system user, do this:
psexec -i -s '"%SystemRoot%\System32\Windows\PowerShell\v1.0\powershell.exe -file "C:\Program Files\SplunkUniversalForwarder\bin\scripts\RESENDREQUEST.ps1"'
If splunk is running as another user, do this:
runas /noprofile /env /user:domain\username '"%SystemRoot%\System32\Windows\PowerShell\v1.0\powershell.exe -file "C:\Program Files\SplunkUniversalForwarder\bin\scripts\RESENDREQUEST.ps1"'
If it runs remote connections as it appears it does... you probably want to add
/netonly to the runas
If you are running 6.3 PowerShell is supported natively:
If not I would probably go and install the PowerShell add-on:
If you can't (or don't want) to install the add-on, then double check paths and quotes in your scripts as this is usually the most common source of error. See this other post.
That's great news.
If you are happy with the answer then could you mark is as "answered" so that others can benefit from it?
He could mark it as the answer, but he might want to change his question if so.
I gave steps on troubleshooting powershell, you hit the nail on the head as to his root issue. The question doesnt mention latest Splunk.
Good to know it has native support now!