Run a script after Splunk service stops

[cboillot]

If I were to have the UF run a PowerShell script, and that script stops the UF, does that also end that PowerShell script session? If so, is there a way to keep it running?

[scelikok]

Hi @cboillot,

I think you are trying to run a script to change setting UF and restart. Stopping the UF process will also stop the Powershell script since it is a child.

You can continue your Powershell actions using another Powershell script by starting a second script for stopping or restarting UF. You should start the second one using the "Start-Process" command. This command will create a separate process that will not be the child of UF.

[cboillot]

This is what I had thought, but its not working. It gets to the point were it stops Splunk, but then nothing. The file I have in referenced in the inputs is named 'kickoff.ps1'. 

start-process powershell.exe "-noexit -noprofile -executionpolicy bypass . C:\SplunkUniversalForwarder\etc\apps\upgradeTest\bin\splunkforwarder-install.ps1"

This is working as it the referenced script stops Splunk. But after that, it just stops. The script itself works as I can run it from the desktop successfully. 

[gcusello]

Hi @cboillot,

sorry but using Splunk you cannot run actions on Universal Forwarders, you have to find a different way.

As a workaround, you could create an alert on the Splunk server that runs a remote Powershell script, if acceptable for you.

Ciao.

Giuseppe