Based on the splunkd.log file it is failing on the powershell string. 01-07-2016 11:43:45.634 -0800 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'"" & : The term 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\ 01-07-2016 11:43:45.634 -0800 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'"" get_dns_analytics.ps1' is not recognized as the name of a cmdlet, function, 01-07-2016 11:43:45.634 -0800 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'"" script file, or operable program. Check the spelling of the name, or if a path 01-07-2016 11:43:45.634 -0800 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'"" was included, verify that the path is correct and try again. 01-07-2016 11:43:45.634 -0800 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'"" At line:1 char:3 01-07-2016 11:43:45.634 -0800 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'"" + & 01-07-2016 11:43:45.634 -0800 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'"" 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_anal 01-07-2016 11:43:45.634 -0800 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'"" ... 01-07-2016 11:43:45.634 -0800 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'"" + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ 01-07-2016 11:43:45.634 -0800 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'"" ~~~ 01-07-2016 11:43:45.634 -0800 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'"" + CategoryInfo : ObjectNotFound: (D:\SplunkUniver...s_analytics.p 01-07-2016 11:43:45.634 -0800 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'"" s1:String) [], CommandNotFoundException 01-07-2016 11:43:45.634 -0800 ERROR ExecProcessor - message from "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -command "& 'D:\SplunkUniversalForwarder\etc\apps\TA-WindowsDNSAnalytical\bin\get_dns_analytics.ps1'"" + FullyQualifiedErrorId : CommandNotFoundException Is there a way I can execute the Splunk .path file manually to see where it is failing? ... View more

I created a local/inputs.conf file with the content you provided and restarted Splunk. I am able to run the Powershell file and it returns the expect results the console window. What I'm unclear on is do I need to setup a Script forwarder on the Splunk server to receive the data from this? When I go to add one it sees the forwarder but when I select scripts it doesn't show this script. ... View more