Getting Data In

Splunk PowerShell Modula Input always returns fallback result

tnicklau
New Member

Hello Community,

I have setup a PowerShell modular input; executing a script every 5 minutes.

Running the script on the splunk (enterprise) server in PS ISE - I get the following output:
host :
Server_IP :
Page_Return_Code : 200
Page_Return_Message : OK
Page_Execution_Time : 1800
Page_Login_Result : Good
source : PowerShell/Connectivity

I can assume, the script itself is working fine.

Calling the same from splunk, I get:
host=""
Server_IP=""
Page_Return_Code="-1"
Page_Return_Message="DOWN"
Page_Execution_Time="2222"
Page_Login_Result="Bad"
source="PowerShell/Connectivity"

Question 1)
Executing the script via splunk modular input, why do I get the opposite result? Do I need to tell the input someplace, to execute the script always on the splunk server?

Question 2)
How to I get splunk to automatically separate the 'Event' into fields?

Snippets from the PS script (server and IP values have been omitted):

Definition of the Splunk return object

$SplunkObject = [PSCustomObject]@{
host = '
Server_IP = ''
Page_Return_Code = ''
Page_Return_Message = ''
Page_Execution_Time = ''
Page_Login_Result = ''
source = "PowerShell/Connectivity"
}
.....

Return values to Splunk Event Adapter

Write-output $SplunkObject

0 Karma

ansif
Motivator

Where you are running this script?

Paste the whole script .

0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...