Getting Data In

Is there a way to run a PowerShell script locally from Splunk?

SplunkIsLife
Explorer

I'm trying to hit an API with a PowerShell command through Splunk without needing to ingest the logs on a regular cadence (and setting up a VM to forward the logs, etc). Is there a way to do this with a command similar to the |jira command?

JDukeSplunk
Builder

I don't see why not.

We have some powershell scripts that we just kick off by way of a batch file. So get a working batch file that runs your powershell the way you would expect, then put the batch file in Splunk at whatever internval/sourcetype whatever you like in Settings>>Data inputs>>Scripts.

Or maybe under
Powershell v3 Modular Input
Settings>>Data inputs » Powershell v3 Modular Input.

0 Karma

SplunkIsLife
Explorer

Wouldn't this ingest it though? I'm trying to not ingest logs at a regular cadence, just call an API and read logs in on a one-off basis without having them live on an indexer

0 Karma

JDukeSplunk
Builder

Maybe, maybe not. If your powershell/batch executes and writes out to a text/log file but does not echo it to console then Splunk will ingest the command, and the output of the command. @echo off?

Something like..

DATE C:\Somefolder\somefile.bat
DATE C:\Somefolder\somefile.ps1

and that should be it.

You can then tell the file monitor portion of Splunk to read the output file log if you so choose.
If the scripts output verbosely to the console then Splunk will probably pick that up.

I've not done Windows batch in a while or powershell scripting much at all, but I think you would want your file to do the Linux equivalent of >dev null if you don't want Splunk to pickup the actual script output.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...