Getting Data In

Why is the Powershell Modular Input not scheduling the script to run?

Kendo213
Communicator

Here is my inputs.conf:

[powershell://checkdnsext]
script = . "$SplunkHome\etc\apps\test_infra_dnsext_inputs\bin\checkdnsext.ps1"
schedule = `0 */5 * ? * *`
sourcetype = test:powershell
index = test

Here is my Powershell located in /app/bin:

$ErrorActionPreference="SilentlyContinue"
$ipaddress = $(ipconfig | where {$_ -match 'IPv4.+\s(\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})' } | out-null; $Matches[1])
$dnstest=Resolve-DnsName -Name google.com -server $ipaddress -QuickTimeout -Type A | select Name
if ($dnstest -like '*google*') {
$result="1"
write-host ((get-date),"`nExternal DNS Status:","$result")
}
else{
$result="0"
write-host ((get-date),"`nExternal DNS Status:","$result")
}

The script works. I don't see any errors in splunkd.log on the client, other than the fact that I don't see it scheduling the script to run.

Any ideas?

0 Karma

ansif
Motivator

Can you try with a service restart.

0 Karma

Kendo213
Communicator

I've tried restarting the service numerous times. That cron has 's around it because of the Splunk forum. It doesn't complain about an invalid cron in the internal logs.

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...