The techniques you're using look like a mix of old-school text-mode and PowerShell modular input. Are you using the Splunk AddOn for Microsoft PowerShell? See the output notes here, but the modular input expects you to output OBJECTS, not strings.
If you're not using the AddOn, then the "SPLUNKTIME" member doesn't do anything:
Connect-VIServer -Server server_name -user user_name -Password password
ForEach ($Datacenter in (Get-Datacenter | Sort-Object -Property Name)) {
ForEach ($Cluster in ($Datacenter | Get-Cluster | Sort-Object -Property Name)) {
ForEach ($VM in ($Cluster | Get-VM | Sort-Object -Property Name)) {
'{0:yyyy-MM-dd HH:mm:ss} VM_Guest="{1}" VM_Datacenter="{2}" VM_Cluster="{3}" VM_Host="{4}"' -f (
(get-date), $VM.Name, $Datacenter.name, $Cluster.Name, $vm.VMHost.Name)
}
}
}
Disconnect-VIServer -server sw-vcenterpr71 -Confirm:$False
If you are, then you need to output an object, not a string. While I'm at it, I'd like to suggest you're wasting time making the extra calls to get the datacenter and cluster information, as it's already on the VM, and there's no point in sorting data that's going into Splunk:
Connect-VIServer -Server server_name -user user_name -Password password
Get-VM | Select-Object @{
Name = "VM_Host"; Expression = { $_.VMHost.Name } }, @{
Name = "VM_Guest"; Expression = { $_.Name } }, @{
Name = "VM_Cluster"; Expression = { $_.VMHost.Parent.Name } }, @{
Name = "VM_Datacenter"; Expression = { $_.VMHost.Parent.ParentFolder.Parent.Name } }, @{
Name = "SplunkTime"; Expression = {Get-Date}
} # | Sort VM_Datacenter, VM_Cluster, VM_Host, VM_Guest
Disconnect-VIServer -Server server_name -Confirm:$False
You could put the sort back by just uncommenting that line, if you care about the order, and don't worry about the format of that date in your console, the modular input formats all DataTime objects according to the ISO standard format that Splunk recognizes, and it'll end up as _time in Splunk.
... View more
