Running a PowerShell script as admin in Splunk

[jdhart1312]

I have a PowerShell script that needs to be ran as admin to be able to load in all of the data. It returns a .csv file that exports to the lookups folder so that we can pull out the data and use said data. I have the script in the correct directory in the Splunk server and can see it and I can run it but I'm not getting data out of it which is making me think that the script is not being ran as an admin. I've tried a few things but can't get it to work correctly.

I've come to a couple of different options for what to do here.

1. Make a managed service account that runs the script as an admin.
2. Try to configure splunkd to allow running as admin (if possible?)
3. Other recommendations?

I'm relatively new to Splunk. Just trying to learn all I can and I appreciate any pointers/guidance. 

[saranvishva]

Hi have you met all the following conditions,

• The Splunk platform instance must be configured to use the Local System user to run all PowerShell scripts.
• PowerShell version 3.0 or higher must be installed on the machine. Microsoft .NET version 4.5 or higher must be installed on the machine.
• There might be additional requirements to run PowerShell scripts depending on the version of Windows and PowerShell. See the Microsoft documentation on PowerShell for details.

[deepakc]

First manually create the lookup and the definitions if using CLI use the below example and test it in splunk, so you know this works. (It sounds like you have done this, not sure)

Ensure this knowledge Object inside your app/lookup folder and  the lookup  is shared for all - (you may have done this all in the GUI,not sure) 

/yourapp/local/transforms.conf
[mylookup]
filename = my_lookup.csv

From your Splunk search bar run the below - to see the data
inputputlookup mylookup

If this works then it must be a permissions issue somewhere post your powershell script process, ensure the splunk user or what user you have used on the Splunk/Windows patform can read the lookup file and its the same name when you created it, like in the transfoms.