Okay, so, this is what I see in the source field in splunk web
"C:\
Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File "C:\Program Files\SplunkUniversalForwarder\etc\apps\appname\bin\LongRunningQueriesRpt.ps1""
When I put that in the props.conf on the indexer I still get the warnings. I apologize for the delay. Initially, I was not on the indexer, and I didn't have permissions to it. Now, I do. This is what I have tried so far.
[source::"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -File \"C:\Program Files\SplunkUniversalForwarder\etc\apps\appname\bin\LongRunningQueriesRpt.ps1\""]
TRUNCATE = 0
[source::...LongRunningQueriesRpt.ps1]
TRUNCATE = 0
... View more