Getting Data In

Testing Splunk UF config on Windows, with Inspec.

northernstar002
New Member

Hi,

I have 2 installations of Splunk. One on a Linux image, one on a Windows 2016 image - both on AWS.

I am testing that that both Trend and Splunk are configured correctly. I have a complete set of tests for the Linux version, but I'm having trouble refactoring for Windows Powershell (I am running my tests remotely and RDP-ing to the Windows VM.

My Linux code is as follows:


Splunk_Server = attribute('Splunk_Server')
Splunk_User = attribute('Splunk_User')
Splunk_Password = attribute('Splunk_Password')

describe command("sudo /opt/splunkforwarder/bin/splunk list forward-server -auth #{Splunk_User}:#{Splunk_Password}") do
its ('stdout') {should match /^Active.forwards:\n\t#{Splunk_Server}\nConfigured.but.inactive.forwards:\n\tNone/}

end


So, I want to read the output of the Linux command and have Inspec verify the output. The command will obviously change for Powershell. Any ideas what this would be to obtain the same result?

Thanks in advance

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...