PS> Import-Module 'C:\Program Files\SplunkUniversalForwarder\etc\apps\SA-ModularInput-PowerShell\windows_x86_64\bin\Modules\LocalStorage\LocalStorage.psm1' PS> .\Invoke-MonitoredScript.ps1 cmdlet Invoke-MonitoredScript.ps1 at command pipeline position 1 Supply values for the following parameters: Command: .\dbinstances.ps1 SplunkSourceType : Powershell:ScriptExecutionSummary Identity : a55a383a-fb73-4851-b3fd-7372fccb03ac InvocationLine : .\Invoke-MonitoredScript.ps1 TerminatingError : False ErrorCount : 0 ... View more

So MSSQL:Instance:Information sourcetype is a powershell input. I am able to run this powershell successfully on the SQL Server, but I get no results on the search head for sourcetype=MSSQL:Instance:Information. Any ideas? ------ inputs.conf -------- [powershell://DBInstances] script = & "$SplunkHome\etc\apps\TA-SQLServer\bin\Invoke-MonitoredScript.ps1" -Command ".\dbinstances.ps1" schedule = 0 */5 * ? * * index = mssql sourcetype = MSSQL:Instance:Information source = Powershell --------------------------- ... View more

Check the inputs.conf and all the powershell scripts in the TA-SQLServer directory. Replace any references to $SplunkHome with the path to the SplunkUniversalForwarder you installed. You're TA-SQLServer scripts didn't find any components because you didn't run Import-Module first to import the required .psm1 files ... View more

Add this to $SPLUNK_HOME/etc/system/local/alert_actions.conf [email] reportServerEnabled = 1 Then tail $SPLUNK_HOME/var/log/splunk/python.log as you test scheduled pdf delivery to see the status of the pdf generation ... View more

Thanks for the tip jervin. We were able to use splunk sso w/ shibboleth using this apache config: <VirtualHost _default_:443> ServerAdmin [email protected] DocumentRoot /var/www/ ErrorLog /var/log/apache2/error.log LogLevel warn CustomLog /var/log/apache2/ssl_access.log combined SSLEngine on SSLCertificateFile /etc/ssl/certs/myhost.pem SSLCertificateKeyFile /etc/ssl/private/myhost.key <Location /> AuthType shibboleth ShibRequestSetting requireSession 1 ShibUseHeaders On require ou staff </Location> ProxyRequests Off <Proxy *> Order deny,allow Allow from all </Proxy> ProxyPass / http://127.0.0.1:8000/ ProxyPassReverse / http://127.0.0.1:8000/ </VirtualHost> We couldn't get apache to pass REMOTE_USER so we told splunk to map the 'uid' variable passed by shib instead in $SPUNK_HOME/etc/system/local/web.conf: [settings] trustedIP = 127.0.0.1 SSOMode = strict remoteUser = uid login_content = <b>ACCESS DENIED</b>: You are not authorized to access Splunk! If the user successfully authenticated to shib but they're not authorized to access splunk then they're prompted to authenticate in splunkweb. Not sure if it's the best way, but I simply added an ACCESS DENIED message in the login screen (login_content parameter). Also, the 'logout' link in splunk is essentially useless now with SSO. You can remove it by navigating to 'Splunk->Manager->User Interface->Views->App Context: search->dashboard' and editing this module: <module name="AccountBar" layoutPanel="appHeader"> <param name="mode">popup</param> </module> ... View more