I am tearing my hair out trying to figure this one out... I had a powershell input on my UFs (both Win10 and Server 16) that was working fine until last week, when the events mysteriously stopped coming into my indexer. Here's the stanza from inputs.conf:
[powershell://MPComputerStatus]
script = get-mpcomputerstatus
schedule = 5
sourcetype = Windows:MPComputerStatus
(note that the schedule of 5 is just for debugging currently; normally it is set to 300)
Everything appears to be functioning normally on the UF side - I look at splunk-powershell.ps1.log and I see the same lines from before and after the issue started:
11-11-2021...INFO Start executing script=get-mpcomputerstatus for stanza=MPComputerStatus
11-11-2021...INFO End of executing script..., execution time=0.0149976 seconds
However, the events do not show up under sourcetype=windows:mpcomputerstatus anymore. All of the Windows event log events are still being forwarded. Here's what I have tried:
- updating Splunk and the forwarders from 8.1.2 to 8.2.3
- running the UF service as both a domain service account (the previous setting) and Local System
- changing the logging config to DEBUG in log.cfg, log-cmdline.cfg
Also, I found it odd that all of my Win10 workstations stopped on the same day, and my Server 2016 machine stopped on a different day.
Any ideas?
