The below setup doesn't appear to index the script's output and I can't figure out why.  Even the basic one-liner example in their documentation (https://docs.splunk.com/Documentation/Splunk/latest/Data/MonitorWindowsdatawithPowerShellscripts) doesn't produce indexed events for me.  I've tried several variations on how the data is being formatted.  I know the script executes because the file change it makes is occurring. configureBINDIP.ps1 $launchConfFile = "C:\Program Files\SplunkUniversalForwarder\etc\splunk-launch.conf" $launchConfSetting = "SPLUNK_BINDIP=127.0.0.1" function CraftEvent ($message) { $event = [PSCustomObject]@{ "SplunkIndex" = "windows" "SplunkSource" = "powershell" "SplunkSourceType" = "Powershell:ConfigureBINDIP" "SplunkHost" = "mysplunkhost" "SplunkTime" = (New-TimeSpan -Start $(Get-Date -Date "01/01/1970") -End $(Get-Date)).TotalSeconds "Message" = $message } Return $event } if (-not (Test-Path $launchConfFile) ) { $event = [PSCustomObject]@{ "Message" = "Could not locate splunk-launch.conf: $launchConfFile" } Write-Output $event | Select-Object exit } if ( (Get-Content $launchConfFile ) -notcontains $launchConfSetting ) { $message = "Appending '$launchConfSetting' to '$launchConfFile'" "`r`n$launchConfSetting" | Out-File $launchConfFile -Append utf8 if ( (Get-Content $launchConfFile ) -contains $launchConfSetting ) { $message += ".... splunk-launch.conf update successful. Please remove this host from the app to restart." } else { $message += ".... splunk-launch.conf does not appear updated. Please continue to monitor." } } else { $message = "splunk-launch.conf already appears updated. Please remove this host from the app to restart." } $event = [PSCustomObject]@{ "Message" = $message } Write-Output $event | Select-Object inputs.conf [powershell://ConfigureBINDIP] script = . "$SplunkHome\etc\apps\configure_bindip\bin\configureBINDIP.ps1" index = windows source = powershell sourcetype = Powershell:ConfigureBINDIP  web.conf [settings] mgmtHostPort = 127.0.0.1:8089   ... View more