Hello,
We have this add-on installed (version 1.0.0) and there are tmp files being created on some Active Directory servers but not being removed. The content of the tmp files are as follows:
constants
SplunkCheckpointPath:C:\Program Files\SplunkUniversalForwarder\var\lib\splunk\modinputs\powershell
SplunkHome:C:\Program Files\SplunkUniversalForwarder
SplunkServerHost:host1234
SplunkServerName:host1234
SplunkServerUri:https://127.0.0.1:8089
SplunkSessionKey:sessionkey
stanzas
stanza:AD-Health
event_group:-1,1
index:msad
script:& "$SplunkHome\etc\apps\Splunk_TA_microsoft_ad\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-health.ps1"
source:Powershell
sourcetype:MSAD:NT6:Health
stanza:Replication-Stats
event_group:-1,2
index:msad
script:& "$SplunkHome\etc\apps\Splunk_TA_microsoft_ad\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-repl-stats.ps1"
source:Powershell
sourcetype:MSAD:NT6:Replication
stanza:Siteinfo
event_group:-1,3
index:msad
script:& "$SplunkHome\etc\apps\Splunk_TA_microsoft_ad\bin\Invoke-MonitoredScript.ps1" -Command ".\powershell\2012r2-siteinfo.ps1"
source:Powershell
sourcetype:MSAD:NT6:SiteInfo
Can someone please help investigate what is causing this? I suspect that the logging is not configured correctly here.
... View more