Getting Data In

Splunk powershell


Here we are using a PowerShell script to extract the data from the AD subnets from a windows server

This is scheduled to run once every week to pull the list of subnets on a particular root domain

We are supposed to get the results only from a parent domain, instead we are getting the results from the subdomains which is not the expected result.

Also when we run the Script in PowerShell ISE directly we are getting a list of subnets from a domain , but the result we see in splunk is entirely different from different domains than the results we get while running the script locally

Since the results contains the subnets and IP Address we are unable to attach the screenshot due to the sensitivity of the results.

Script used “

# extract domain rootDNS
$domain=$([adsi] "LDAP://RootDSE").Get("rootDomainNamingContext") -replace "DC=","" -replace ",","."

# create LDAP path for AD subnets
$subnetsDN="LDAP://CN=Subnets,CN=Sites," + $([adsi] "LDAP://RootDSE").Get("ConfigurationNamingContext")

#ouput properties
$props = @{domain=$domain;ip="";sitename=""}

# get subnets and loop through list
foreach ($subnetDN in $([adsi] $subnetsDN).psbase.children){
$tmpTable = new-object psobject -property $props
# get CN of the subnet's site objects
$tmpTable.sitename=$([adsi] "LDAP://$($subnetDN.siteObject)").cn.tostring()
# validate sitename
if($tmpTable.sitename -ne $null){
#extract subnet CN
#write output
$tmpTable |select domain, ip, sitename


Input Stanza:

script = . "$SplunkHome\etc\apps\bhp_hf_ad_audit_powershell_subnet\bin\RunAudit-ADSubnets.ps1"
schedule = 30 15 * * 0
sourcetype = microsoft:ad:subnets


Labels (2)
0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...