Getting Data In

Is there a way to run a PowerShell script locally from Splunk?

SplunkIsLife
Explorer

I'm trying to hit an API with a PowerShell command through Splunk without needing to ingest the logs on a regular cadence (and setting up a VM to forward the logs, etc). Is there a way to do this with a command similar to the |jira command?

JDukeSplunk
Builder

I don't see why not.

We have some powershell scripts that we just kick off by way of a batch file. So get a working batch file that runs your powershell the way you would expect, then put the batch file in Splunk at whatever internval/sourcetype whatever you like in Settings>>Data inputs>>Scripts.

Or maybe under
Powershell v3 Modular Input
Settings>>Data inputs » Powershell v3 Modular Input.

0 Karma

SplunkIsLife
Explorer

Wouldn't this ingest it though? I'm trying to not ingest logs at a regular cadence, just call an API and read logs in on a one-off basis without having them live on an indexer

0 Karma

JDukeSplunk
Builder

Maybe, maybe not. If your powershell/batch executes and writes out to a text/log file but does not echo it to console then Splunk will ingest the command, and the output of the command. @echo off?

Something like..

DATE C:\Somefolder\somefile.bat
DATE C:\Somefolder\somefile.ps1

and that should be it.

You can then tell the file monitor portion of Splunk to read the output file log if you so choose.
If the scripts output verbosely to the console then Splunk will probably pick that up.

I've not done Windows batch in a while or powershell scripting much at all, but I think you would want your file to do the Linux equivalent of >dev null if you don't want Splunk to pickup the actual script output.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...