Getting Data In

Why is my powershell script for input-stanza not working?

morethanyell
Builder

Hi community! I've tried and exhausted all my brain cells but I still couldn't make this work. Any ideas?

Below is deployed into a Windows 11 machine, running UF 9.1.1

splunk-playground/TA-powershell_scripting/local/inputs.conf at main · morethanyell/splunk-playground...

Labels (2)
0 Karma
1 Solution

morethanyell
Builder

Thanks to reddit user u/chadbaldwin who pointed out that the fault was in using `Write-Host` rather than `Write-Output`; whereas `Write-Host` isn't something Splunk is able to capture.

Replaced the script to use `Write-Output` and it's now working.

View solution in original post

0 Karma

morethanyell
Builder

Thanks to reddit user u/chadbaldwin who pointed out that the fault was in using `Write-Host` rather than `Write-Output`; whereas `Write-Host` isn't something Splunk is able to capture.

Replaced the script to use `Write-Output` and it's now working.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You've never scripted on unices, have you? 😉

But seriously - that's kinda obvious. I'd say Write-Output is like writing to stdout whereas Write-Host is more like writing to stderr (yes, I know that this analogy is not 100% correct).

0 Karma

morethanyell
Builder

I have very little experience with scripting.

0 Karma

PickleRick
SplunkTrust
SplunkTrust

You specified "schedule" setting instead of "interval".

0 Karma

morethanyell
Builder

In inputs.conf - Splunk Documentation, it says

 

[powershell://<name>]
schedule = [<positive integer>|<cron schedule>]
* How often to run the specified PowerShell command or script.
* You can specify a number in seconds, or provide a valid cron
  schedule.
* Default: Runs the command or script once, at startup.
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Sorry, you're right. I was checking the "script" input and it has the "interval" parameter whereas powershell indeed has "schedule".

How do you know it's not running (and not just running and producing any results for example)?

What does splunk list inputstatus say?

My definition looks almost identical and works. From what I see you avoided the common pitfall of $SplunkHome so the path is good.

[powershell://script-checker]
script= . "$SplunkHome\etc\apps\cert_checker\bin\scripts\Splunk-cert-checker.ps1"
schedule = 86400
index=internal_auxiliary
sourcetype=kv:cert-checker
event_serialization_format=kv
disabled=0

 

0 Karma
Get Updates on the Splunk Community!

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...