Getting Data In

Inconsistent PowerShell Script behaviour

afx
Contributor

Hi,
I am trying to get input from a powershell script.
It drives me up the walls. I already have other PS scripts running just fine, so this really puzzles me.
I have 3 heavy forwarder on Splunk 8.0.2.1 and 18 universal forwarders on Splunk 7.2.4.
When using this inputs.conf setting:

[powershell://df]
script = Get-WmiObject Win32_LogicalDisk | Select-Object DeviceID,Size,FreeSpace | findstr.exe  '[0-9]$'
index = os_monitoring
schedule=*/5 * * * *
source=df-win
sourcetype=os:monitoring:diskspace
disabled = 0

I get only input on 3 UF hosts and 2 HF hosts.
One of the HF hosts delivers the following in the _audit log, but no output.

05-04-2020 16:35:00.0014151+2 INFO enqueue job for stanza=df
05-04-2020 16:35:00.0014151+2 INFO Start executing script=Get-WmiObject Win32_LogicalDisk | Select-Object DeviceID,Size,FreeSpace | findstr.exe  '[0-9]$' for stanza=df
05-04-2020 16:35:00.0170289+2 INFO End of executing script=Get-WmiObject Win32_LogicalDisk | Select-Object DeviceID,Size,FreeSpace | findstr.exe  '[0-9]$' for stanza=df, execution_time=0.0156138 seconds

The other boxes do not deliver anything in terms of output or errors, I just see that the app is deployed.

When switching to a real script like in the following

script = . "$SplunkHome\etc\apps\FA-windows-diskspace\bin\scripts\df.ps1"

I again get the the same result. The majority of systems do not deliver output and I see no errors in the _* indices.

I am a bit lost.
I would expect all machines to fail or none, but not this inconsistent behaviour.

Any ideas?

thx
afx

0 Karma

afx
Contributor

Ok,
to answer my own question...
On Some systems doing a findstr "[0-9]$" worked, on some not. Some Windows/PS silliness I guess.
But that also begs the question, why does splunk not tell me that the script has been executed in general?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...