Getting Data In

Powershell script not running always on schedule - Splunk Add On for Microsoft HyperV

scostic
Observer

Hello, I am running Splunk Add for Microsoft Hyper-V  on 10 different Hyper-V hosts with a splunk forwarder each, but not all powershell scripts are executed on schedule.    My problem is with the long running scripts getvm_inventory.ps1 and getvm_inventoryext.ps1. The rest of the scripts are executed on schedule.

I have the following inputs.conf

############# VM #############
[powershell://GetVM_Inventory]
script = . "$SplunkHome\etc\apps\Splunk_TA_microsoft-hyperv\bin\GetVM_Inventory.ps1"
schedule = 0 0 4-8/1 ? * *
source = microsoft:hyperv:powershell:getvm_inventory.ps1
sourcetype = microsoft:hyperv:vm
index = ctc_hyperv_inventory
disabled = 0

[powershell://GetVM_InventoryEXT]
script = . "$SplunkHome\etc\apps\Splunk_TA_microsoft-hyperv\bin\GetVM_InventoryEXT.ps1"
schedule = 0 20 4-8/1 ? * *
source = microsoft:hyperv:powershell:getvm_inventoryext.ps1
sourcetype = microsoft:hyperv:vm:ext
index = ctc_hyperv_inventory
disabled = 0

 

from the logs I see that they are executed correctly . The only difference from other scripts is the execution that is much longer.

 

01-23-2022 06:00:10.4694493+2 INFO End of executing script=. "$SplunkHome\etc\apps\Splunk_TA_microsoft-hyperv\bin\GetVM_Inventory.ps1" for stanza=GetVM_Inventory, execution_time=10.3504674 seconds
01-23-2022 06:00:00.1169827+2 INFO Start executing script=. "$SplunkHome\etc\apps\Splunk_TA_microsoft-hyperv\bin\GetVM_Inventory.ps1" for stanza=GetVM_Inventory
01-23-2022 06:00:00.1139817+2 INFO enqueue job for stanza=GetVM_Inventory
01-23-2022 05:00:10.5518190+2 INFO End of executing script=. "$SplunkHome\etc\apps\Splunk_TA_microsoft-hyperv\bin\GetVM_Inventory.ps1" for stanza=GetVM_Inventory, execution_time=10.4093991 seconds
01-23-2022 05:00:00.1404194+2 INFO Start executing script=. "$SplunkHome\etc\apps\Splunk_TA_microsoft-hyperv\bin\GetVM_Inventory.ps1" for stanza=GetVM_Inventory
01-23-2022 05:00:00.1374214+2 INFO enqueue job for stanza=GetVM_Inventory
01-23-2022 04:00:13.0595973+2 INFO End of executing script=. "$SplunkHome\etc\apps\Splunk_TA_microsoft-hyperv\bin\GetVM_Inventory.ps1" for stanza=GetVM_Inventory, execution_time=11.6046748 seconds

 

Thank you in advance.

Labels (2)
0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...