Getting Data In

Inconsistent PowerShell Script behaviour

afx
Contributor

Hi,
I am trying to get input from a powershell script.
It drives me up the walls. I already have other PS scripts running just fine, so this really puzzles me.
I have 3 heavy forwarder on Splunk 8.0.2.1 and 18 universal forwarders on Splunk 7.2.4.
When using this inputs.conf setting:

[powershell://df]
script = Get-WmiObject Win32_LogicalDisk | Select-Object DeviceID,Size,FreeSpace | findstr.exe  '[0-9]$'
index = os_monitoring
schedule=*/5 * * * *
source=df-win
sourcetype=os:monitoring:diskspace
disabled = 0

I get only input on 3 UF hosts and 2 HF hosts.
One of the HF hosts delivers the following in the _audit log, but no output.

05-04-2020 16:35:00.0014151+2 INFO enqueue job for stanza=df
05-04-2020 16:35:00.0014151+2 INFO Start executing script=Get-WmiObject Win32_LogicalDisk | Select-Object DeviceID,Size,FreeSpace | findstr.exe  '[0-9]$' for stanza=df
05-04-2020 16:35:00.0170289+2 INFO End of executing script=Get-WmiObject Win32_LogicalDisk | Select-Object DeviceID,Size,FreeSpace | findstr.exe  '[0-9]$' for stanza=df, execution_time=0.0156138 seconds

The other boxes do not deliver anything in terms of output or errors, I just see that the app is deployed.

When switching to a real script like in the following

script = . "$SplunkHome\etc\apps\FA-windows-diskspace\bin\scripts\df.ps1"

I again get the the same result. The majority of systems do not deliver output and I see no errors in the _* indices.

I am a bit lost.
I would expect all machines to fail or none, but not this inconsistent behaviour.

Any ideas?

thx
afx

0 Karma

afx
Contributor

Ok,
to answer my own question...
On Some systems doing a findstr "[0-9]$" worked, on some not. Some Windows/PS silliness I guess.
But that also begs the question, why does splunk not tell me that the script has been executed in general?

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Announcing Modern Navigation: A New Era of Splunk User Experience

We are excited to introduce the Modern Navigation feature in the Splunk Platform, available to both cloud and ...

Modernize your Splunk Apps – Introducing Python 3.13 in Splunk

We are excited to announce that the upcoming releases of Splunk Enterprise 10.2.x and Splunk Cloud Platform ...

Step into “Hunt the Insider: An Splunk ES Premier Mystery” to catch a cybercriminal ...

After a whole week of being on call, you fell asleep on your keyboard, and you hit a sequence of buttons that ...