So I have the two below in my inputs.conf the top one works, the bottom one does not. Both commands work fine when ran on the machines the forwarders are on. I cannot find any differences that I could be missing. Thoughts?
[powershell://Get-ClusterGroup]
script = Get-ClusterGroup | Select Name,OwnerNode,State
schedule = 0 */5 * * *
index = pod-db
disabled = 0
sourcetype = Get-ClusterGroup
[powershell://Get-ClusterNode]
script = Get-ClusterNode | Select Name,ID,State
schedule = 0 */5 * * *
index = pod-db
disabled = 0
sourcetype = Get-ClusterNode
In fact I know they are identical because I did a yank and put in vim to duplicate the top one that works. There is nothing unusual in the splunk-powershell.ps1.log file on the forwarder machine.
Alright, not sure why this worked buy I dropped the "Get-" from Get-ClusterNode in the source and sourcetype and it works. I'm not sure why that's the case but apparently it is.
Alright, not sure why this worked buy I dropped the "Get-" from Get-ClusterNode in the source and sourcetype and it works. I'm not sure why that's the case but apparently it is.
When you say the top one works but the bottom one doesn't, are you just not seeing data for the sourcetype in the pod-db index? Or, do you see some type of error?
Nothing jumps out as wrong in your inputs.conf though. Maybe some setting somewhere else is interfering? My personal next step would be btool to check the expanded inputs.conf -> https://docs.splunk.com/Documentation/Splunk/7.1.0/Troubleshooting/Usebtooltotroubleshootconfigurati...
Something like the following:
./splunk cmd btool inputs list --debug
I'm seeing data for one but not the other. No errors I can find. Here's the btool results from that section. Still looks nearly identical. cwdbsql011-01 is the forwarder machine.
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf [powershell://Get-ClusterGroup]
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf disabled = 0
host = cwdbsql011-01
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf index = pod-db
D:\Program Files\Splunk\etc\system\default\inputs.conf interval = 60
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf schedule = 0 */5 * * *
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf script = Get-ClusterGroup | Select Name,OwnerNode,State
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf sourcetype = Get-ClusterGroup
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf [powershell://Get-ClusterNode]
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf disabled = 0
host = cwdbsql011-01
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf index = pod-db
D:\Program Files\Splunk\etc\system\default\inputs.conf interval = 60
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf schedule = 0 */5 * * *
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf script = Get-ClusterNode | Select Name,ID,State
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf sourcetype = Get-ClusterNode