Getting Data In

Splunk powershell

arunsundarm
Engager

Here we are using a PowerShell script to extract the data from the AD subnets from a windows server

This is scheduled to run once every week to pull the list of subnets on a particular root domain

We are supposed to get the results only from a parent domain, instead we are getting the results from the subdomains which is not the expected result.

Also when we run the Script in PowerShell ISE directly we are getting a list of subnets from a domain , but the result we see in splunk is entirely different from different domains than the results we get while running the script locally


Since the results contains the subnets and IP Address we are unable to attach the screenshot due to the sensitivity of the results.

Script used “

# extract domain rootDNS
$domain=$([adsi] "LDAP://RootDSE").Get("rootDomainNamingContext") -replace "DC=","" -replace ",","."

# create LDAP path for AD subnets
$subnetsDN="LDAP://CN=Subnets,CN=Sites," + $([adsi] "LDAP://RootDSE").Get("ConfigurationNamingContext")

#ouput properties
$props = @{domain=$domain;ip="";sitename=""}

# get subnets and loop through list
foreach ($subnetDN in $([adsi] $subnetsDN).psbase.children){
$tmpTable = new-object psobject -property $props
# get CN of the subnet's site objects
$tmpTable.sitename=$([adsi] "LDAP://$($subnetDN.siteObject)").cn.tostring()
# validate sitename
if($tmpTable.sitename -ne $null){
#extract subnet CN
$tmpTable.ip=$subnetDN.cn.tostring()
#write output
$tmpTable |select domain, ip, sitename

}
}

Input Stanza:

[powershell://Get-ADSubnets]
script = . "$SplunkHome\etc\apps\bhp_hf_ad_audit_powershell_subnet\bin\RunAudit-ADSubnets.ps1"
schedule = 30 15 * * 0
sourcetype = microsoft:ad:subnets

 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...