Two Nearly Identical Inputs But One Doesnt Work (PowerShell)

[JordanPeterson]

So I have the two below in my inputs.conf the top one works, the bottom one does not. Both commands work fine when ran on the machines the forwarders are on. I cannot find any differences that I could be missing. Thoughts?

[powershell://Get-ClusterGroup]
script = Get-ClusterGroup | Select Name,OwnerNode,State
schedule = 0 */5 * * *
index = pod-db
disabled = 0
sourcetype = Get-ClusterGroup

[powershell://Get-ClusterNode]
script = Get-ClusterNode | Select Name,ID,State
schedule = 0 */5 * * *
index = pod-db
disabled = 0
sourcetype = Get-ClusterNode

In fact I know they are identical because I did a yank and put in vim to duplicate the top one that works. There is nothing unusual in the splunk-powershell.ps1.log file on the forwarder machine.

[JordanPeterson · Accepted solution]

Alright, not sure why this worked buy I dropped the "Get-" from Get-ClusterNode in the source and sourcetype and it works. I'm not sure why that's the case but apparently it is.

[jconger]

When you say the top one works but the bottom one doesn't, are you just not seeing data for the sourcetype in the pod-db index? Or, do you see some type of error?

Nothing jumps out as wrong in your inputs.conf though. Maybe some setting somewhere else is interfering? My personal next step would be btool to check the expanded inputs.conf -> https://docs.splunk.com/Documentation/Splunk/7.1.0/Troubleshooting/Usebtooltotroubleshootconfigurati...

Something like the following:

./splunk cmd btool inputs list --debug

[JordanPeterson]

I'm seeing data for one but not the other. No errors I can find. Here's the btool results from that section. Still looks nearly identical. cwdbsql011-01 is the forwarder machine.

D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  [powershell://Get-ClusterGroup]
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  disabled = 0
host = cwdbsql011-01
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  index = pod-db
D:\Program Files\Splunk\etc\system\default\inputs.conf                             interval = 60
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  schedule = 0 */5 * * *
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  script = Get-ClusterGroup | Select Name,OwnerNode,State
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  sourcetype = Get-ClusterGroup
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  [powershell://Get-ClusterNode]
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  disabled = 0
host = cwdbsql011-01
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  index = pod-db
D:\Program Files\Splunk\etc\system\default\inputs.conf                             interval = 60
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  schedule = 0 */5 * * *
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  script = Get-ClusterNode | Select Name,ID,State
D:\Program Files\Splunk\etc\apps\sql_monitoring\local\inputs.conf                  sourcetype = Get-ClusterNode