I have a PowerShell script that needs to be ran as admin to be able to load in all of the data. It returns a .csv file that exports to the lookups folder so that we can pull out the data and use said data. I have the script in the correct directory in the Splunk server and can see it and I can run it but I'm not getting data out of it which is making me think that the script is not being ran as an admin. I've tried a few things but can't get it to work correctly.
I've come to a couple of different options for what to do here.
1. Make a managed service account that runs the script as an admin.
2. Try to configure splunkd to allow running as admin (if possible?)
3. Other recommendations?
I'm relatively new to Splunk. Just trying to learn all I can and I appreciate any pointers/guidance.
Hi have you met all the following conditions,
First manually create the lookup and the definitions if using CLI use the below example and test it in splunk, so you know this works. (It sounds like you have done this, not sure)
Ensure this knowledge Object inside your app/lookup folder and the lookup is shared for all - (you may have done this all in the GUI,not sure)
/yourapp/local/transforms.conf
[mylookup]
filename = my_lookup.csv
From your Splunk search bar run the below - to see the data
inputputlookup mylookup
If this works then it must be a permissions issue somewhere post your powershell script process, ensure the splunk user or what user you have used on the Splunk/Windows patform can read the lookup file and its the same name when you created it, like in the transfoms.