Getting Data In

Powershell input for universal forwarder stopped working

robertjollsdrs
Explorer

I am tearing my hair out trying to figure this one out... I had a powershell input on my UFs (both Win10 and Server 16) that was working fine until last week, when the events mysteriously stopped coming into my indexer. Here's the stanza from inputs.conf:

[powershell://MPComputerStatus]
script = get-mpcomputerstatus
schedule = 5
sourcetype = Windows:MPComputerStatus

(note that the schedule of 5 is just for debugging currently; normally it is set to 300)

Everything appears to be functioning normally on the UF side - I look at splunk-powershell.ps1.log and I see the same lines from before and after the issue started:

11-11-2021...INFO Start executing script=get-mpcomputerstatus for stanza=MPComputerStatus
11-11-2021...INFO End of executing script..., execution time=0.0149976 seconds

However, the events do not show up under sourcetype=windows:mpcomputerstatus anymore. All of the Windows event log events are still being forwarded. Here's what I have tried:

  • updating Splunk and the forwarders from 8.1.2 to 8.2.3
  • running the UF service as both a domain service account (the previous setting) and Local System
  • changing the logging config to DEBUG in log.cfg, log-cmdline.cfg

Also, I found it odd that all of my Win10 workstations stopped on the same day, and my Server 2016 machine stopped on a different day.

Any ideas?

Labels (1)
Tags (1)
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...