Search
  • danielpwilson

Get-NetAdapter PowerShell Scripted Input

Updated: Apr 18, 2020

Just hanging out on Facebook today and I noticed this post.



Honestly this isn't the the first time I've seen this exact question. Powershell scripting in Splunk is little weird and while there are docs https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/MonitorWindowsdatawithPowerShellscripts


I felt it wasn't enough to leave this requester with a link and move on. He needed a "template" to solve his problem. Additionally I was working with Splunk support to get the scripted inputs on Splunk_TA_windows to include MAC address.

The document above asks users to modify system/local which can be very confusing for beginners who want an "app". I dug around on Splunk base and all I could find is my old Wireless service app. Might meet his needs, but doesn't answer the scripted input question.

https://splunkbase.splunk.com/app/3263/

Anyhow so I hammered this out a quick TA. https://github.com/dpwtheitguy/TA-GetNetAdapter I also uploaded to Splunkbase but it's just so simple they might reject it.



[powershell://GetNetAdapter]  
  script = Get-NetAdapter | Write-Output  
  schedule = */5 * * * *  
  sourcetype=Windows:GetNetAdapter  
  disabled = 0



Anyhow, for simple PowerShell scripted inputs I hope that app helps.

50 views0 comments

Recent Posts

See All

So I've been thinking today about how useful Splunk is on the "blue" side of the house. What about the Purple and Red side? What features would Splunk need to gain to add value to the other 2/3rds of