Getting Data In

Splunk PowerShell Modula Input always returns fallback result

tnicklau
New Member

Hello Community,

I have setup a PowerShell modular input; executing a script every 5 minutes.

Running the script on the splunk (enterprise) server in PS ISE - I get the following output:
host :
Server_IP :
Page_Return_Code : 200
Page_Return_Message : OK
Page_Execution_Time : 1800
Page_Login_Result : Good
source : PowerShell/Connectivity

I can assume, the script itself is working fine.

Calling the same from splunk, I get:
host=""
Server_IP=""
Page_Return_Code="-1"
Page_Return_Message="DOWN"
Page_Execution_Time="2222"
Page_Login_Result="Bad"
source="PowerShell/Connectivity"

Question 1)
Executing the script via splunk modular input, why do I get the opposite result? Do I need to tell the input someplace, to execute the script always on the splunk server?

Question 2)
How to I get splunk to automatically separate the 'Event' into fields?

Snippets from the PS script (server and IP values have been omitted):

Definition of the Splunk return object

$SplunkObject = [PSCustomObject]@{
host = '
Server_IP = ''
Page_Return_Code = ''
Page_Return_Message = ''
Page_Execution_Time = ''
Page_Login_Result = ''
source = "PowerShell/Connectivity"
}
.....

Return values to Splunk Event Adapter

Write-output $SplunkObject

0 Karma

ansif
Motivator

Where you are running this script?

Paste the whole script .

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Manage Edge Processor pipelines end to end with APIs

This guide uses the Data Management APIs to create an Edge Processor, onboard one instance, deploy a pipeline ...

Splunk Brings Proof of Control to Digital Asset Transfers

Digital assets now sit inside the core of financial services. HSBC launched its Tokenized Deposit Service in ...

Manage Ingest Processor pipelines end to end with APIs

This guide uses the Data Management APIs to create an Ingest Processor pipeline, deploy it to the ...