Getting Data In

Run a script after Splunk service stops

cboillot
Contributor

If I were to have the UF run a PowerShell script, and that script stops the UF, does that also end that PowerShell script session? If so, is there a way to keep it running?

Labels (2)
Tags (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @cboillot,

I think you are trying to run a script to change setting UF and restart. Stopping the UF process will also stop the Powershell script since it is a child.

You can continue your Powershell actions using another Powershell script by starting a second script for stopping or restarting UF. You should start the second one using the "Start-Process" command. This command will create a separate process that will not be the child of UF.

If this reply helps you an upvote is appreciated.

cboillot
Contributor

This is what I had thought, but its not working. It gets to the point were it stops Splunk, but then nothing. The file I have in referenced in the inputs is named 'kickoff.ps1'. 

start-process powershell.exe "-noexit -noprofile -executionpolicy bypass . C:\SplunkUniversalForwarder\etc\apps\upgradeTest\bin\splunkforwarder-install.ps1"

This is working as it the referenced script stops Splunk. But after that, it just stops. The script itself works as I can run it from the desktop successfully. 

0 Karma

gcusello
Esteemed Legend

Hi @cboillot,

sorry but using Splunk you cannot run actions on Universal Forwarders, you have to find a different way.

As a workaround, you could create an alert on the Splunk server that runs a remote Powershell script, if acceptable for you.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...