Why is Powershell input not receiving data?

[mikelanghorst]

I had a windows admin create a powershell script for me (requires code-signing, plus app whitelisting complexity), and have configured as a Splunk input.  It's working fine from a powershell prompt, and I can see from _internal that Splunk is executing it, but I'm receiving no output.

Script:

#main
$command =
{
  try
  {
    $Response = Invoke-WebRequest -Uri 'www.google.com'
    $StatusCode = $Response.StatusCode
  }
  catch
  {
    $StatusCode = $_.Exception.Response.StatusCode.value__
    if ($StatusCode -eq $null){
      $StatusCode = '000'
    }
  }
  return $StatusCode
}
$StatusCode = invoke-command  -ScriptBlock $command
Switch ($StatusCode) {
  '000' { write-warning ('Web_Connectivity url=www.google.com status=failure status_code={0}' -f $statuscode) -Verbose }
  default { write-host ('Web_Connectivity url=www.google.com status=success status_code={0}' -f $statuscode) -ForegroundColor Green }
}

With this inputs.conf:

[powershell://test-internetaccessSplunk]
script = . "$SplunkHome\etc\apps\test_Windows_Scripts\bin\test-internetaccessSplunk.ps1"
schedule = */5 * 9-16 * 1-5
sourcetype = Script:Web_Connectivity
source = Script:Web_Connectivity
index = win_test

*note:  schedule to be updated to once/day once it works.

_internal log events: 

05-10-2022 09:45:00.0001576-7 INFO Start executing script=. "$SplunkHome\etc\apps\test_Windows_Scripts\bin\test-internetaccessSplunk.ps1" for stanza=test-internetaccessSplunk
05-10-2022 09:45:00.8595184-7 INFO End of executing script=. "$SplunkHome\etc\apps\test_Windows_Scripts\bin\test-internetaccessSplunk.ps1" for stanza=test-internetaccessSplunk, execution_time=0.8593608 seconds

[mikelanghorst]

No, transcription isn't enabled.    Splunk version is 8.1.6.

[jho-splunk]

Hi @mikelanghorst ,

Do you have PowerShell Transcription enabled, perchance?  And also, what is the version of the Splunk that is running the PowerShell modular input?

Cheers,

 - Jo.