@DonDandrea do you mind share your solution, i have the same requirement but i can't seem to get it to work. ... View more

I got it working! Thanks to everyone that contributed. ... View more

@JasonMcMahan you created a new HEC input and used the token? ... View more

He did run the cmdlet Get-IISAppPool and got the desired result from power shell prompt. But my issue is how to implement this in splunk to be able to see the same status and use them to set alerts. The AppPool data that is in splunk does not include the status nor event codes associated with the status. So my assessment is that a new input script is required, but can’t figure it out ... View more

Hi @JHannan I have similar requirement, did you ever get this resolved? If so, could you please share with me the working PS script and the inputs.conf file that you are using. I have a requirement to get the IIS AppPool Status from Splunk which will send an alert if the status changes to "stopped". Thanks in advance ... View more

@jsmithn  I have the same requirement at work, could you please post a walkthrough how you were able to get the fields such as status etc. The logs does not show these fields. Any help will be appreciated.  ... View more

Totally! thank you. ... View more

@venkatasri  thank you for the response, however,  I was just wondering what will happen if the cluster master goes down, will the SH be able to return results of an adhoc search? ... View more