Getting Data In

Run a script after Splunk service stops

cboillot
Communicator

If I were to have the UF run a PowerShell script, and that script stops the UF, does that also end that PowerShell script session? If so, is there a way to keep it running?

Labels (2)
Tags (1)
0 Karma

scelikok
SplunkTrust
SplunkTrust

Hi @cboillot,

I think you are trying to run a script to change setting UF and restart. Stopping the UF process will also stop the Powershell script since it is a child.

You can continue your Powershell actions using another Powershell script by starting a second script for stopping or restarting UF. You should start the second one using the "Start-Process" command. This command will create a separate process that will not be the child of UF.

If this reply helps you an upvote is appreciated.

cboillot
Communicator

This is what I had thought, but its not working. It gets to the point were it stops Splunk, but then nothing. The file I have in referenced in the inputs is named 'kickoff.ps1'. 

start-process powershell.exe "-noexit -noprofile -executionpolicy bypass . C:\SplunkUniversalForwarder\etc\apps\upgradeTest\bin\splunkforwarder-install.ps1"

This is working as it the referenced script stops Splunk. But after that, it just stops. The script itself works as I can run it from the desktop successfully. 

0 Karma

gcusello
Legend

Hi @cboillot,

sorry but using Splunk you cannot run actions on Universal Forwarders, you have to find a different way.

As a workaround, you could create an alert on the Splunk server that runs a remote Powershell script, if acceptable for you.

Ciao.

Giuseppe

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!