Getting Data In

Splunk powershell

arunsundarm
Engager

Here we are using a PowerShell script to extract the data from the AD subnets from a windows server

This is scheduled to run once every week to pull the list of subnets on a particular root domain

We are supposed to get the results only from a parent domain, instead we are getting the results from the subdomains which is not the expected result.

Also when we run the Script in PowerShell ISE directly we are getting a list of subnets from a domain , but the result we see in splunk is entirely different from different domains than the results we get while running the script locally


Since the results contains the subnets and IP Address we are unable to attach the screenshot due to the sensitivity of the results.

Script used “

# extract domain rootDNS
$domain=$([adsi] "LDAP://RootDSE").Get("rootDomainNamingContext") -replace "DC=","" -replace ",","."

# create LDAP path for AD subnets
$subnetsDN="LDAP://CN=Subnets,CN=Sites," + $([adsi] "LDAP://RootDSE").Get("ConfigurationNamingContext")

#ouput properties
$props = @{domain=$domain;ip="";sitename=""}

# get subnets and loop through list
foreach ($subnetDN in $([adsi] $subnetsDN).psbase.children){
$tmpTable = new-object psobject -property $props
# get CN of the subnet's site objects
$tmpTable.sitename=$([adsi] "LDAP://$($subnetDN.siteObject)").cn.tostring()
# validate sitename
if($tmpTable.sitename -ne $null){
#extract subnet CN
$tmpTable.ip=$subnetDN.cn.tostring()
#write output
$tmpTable |select domain, ip, sitename

}
}

Input Stanza:

[powershell://Get-ADSubnets]
script = . "$SplunkHome\etc\apps\bhp_hf_ad_audit_powershell_subnet\bin\RunAudit-ADSubnets.ps1"
schedule = 30 15 * * 0
sourcetype = microsoft:ad:subnets

 

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...

Splunk AppDynamics Agents Webinar Series

Mark your calendars! On June 24th at 12PM PST, we’re going live with the second session of our Splunk ...

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...