Getting Data In

Is there a way to run a PowerShell script locally from Splunk?

SplunkIsLife
Explorer

I'm trying to hit an API with a PowerShell command through Splunk without needing to ingest the logs on a regular cadence (and setting up a VM to forward the logs, etc). Is there a way to do this with a command similar to the |jira command?

JDukeSplunk
Builder

I don't see why not.

We have some powershell scripts that we just kick off by way of a batch file. So get a working batch file that runs your powershell the way you would expect, then put the batch file in Splunk at whatever internval/sourcetype whatever you like in Settings>>Data inputs>>Scripts.

Or maybe under
Powershell v3 Modular Input
Settings>>Data inputs » Powershell v3 Modular Input.

0 Karma

SplunkIsLife
Explorer

Wouldn't this ingest it though? I'm trying to not ingest logs at a regular cadence, just call an API and read logs in on a one-off basis without having them live on an indexer

0 Karma

JDukeSplunk
Builder

Maybe, maybe not. If your powershell/batch executes and writes out to a text/log file but does not echo it to console then Splunk will ingest the command, and the output of the command. @echo off?

Something like..

DATE C:\Somefolder\somefile.bat
DATE C:\Somefolder\somefile.ps1

and that should be it.

You can then tell the file monitor portion of Splunk to read the output file log if you so choose.
If the scripts output verbosely to the console then Splunk will probably pick that up.

I've not done Windows batch in a while or powershell scripting much at all, but I think you would want your file to do the Linux equivalent of >dev null if you don't want Splunk to pickup the actual script output.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...