I had a windows admin create a powershell script for me (requires code-signing, plus app whitelisting complexity), and have configured as a Splunk input. It's working fine from a powershell prompt, and I can see from _internal that Splunk is executing it, but I'm receiving no output.
Script:
#main
$command =
{
try
{
$Response = Invoke-WebRequest -Uri 'www.google.com'
$StatusCode = $Response.StatusCode
}
catch
{
$StatusCode = $_.Exception.Response.StatusCode.value__
if ($StatusCode -eq $null){
$StatusCode = '000'
}
}
return $StatusCode
}
$StatusCode = invoke-command -ScriptBlock $command
Switch ($StatusCode) {
'000' { write-warning ('Web_Connectivity url=www.google.com status=failure status_code={0}' -f $statuscode) -Verbose }
default { write-host ('Web_Connectivity url=www.google.com status=success status_code={0}' -f $statuscode) -ForegroundColor Green }
}
With this inputs.conf:
[powershell://test-internetaccessSplunk]
script = . "$SplunkHome\etc\apps\test_Windows_Scripts\bin\test-internetaccessSplunk.ps1"
schedule = */5 * 9-16 * 1-5
sourcetype = Script:Web_Connectivity
source = Script:Web_Connectivity
index = win_test
*note: schedule to be updated to once/day once it works.
_internal log events:
05-10-2022 09:45:00.0001576-7 INFO Start executing script=. "$SplunkHome\etc\apps\test_Windows_Scripts\bin\test-internetaccessSplunk.ps1" for stanza=test-internetaccessSplunk
05-10-2022 09:45:00.8595184-7 INFO End of executing script=. "$SplunkHome\etc\apps\test_Windows_Scripts\bin\test-internetaccessSplunk.ps1" for stanza=test-internetaccessSplunk, execution_time=0.8593608 seconds
