Just hanging out on Facebook today and I noticed this post.
Honestly this isn't the the first time I've seen this exact question. Powershell scripting in Splunk is little weird and while there are docs https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/MonitorWindowsdatawithPowerShellscripts
I felt it wasn't enough to leave this requester with a link and move on. He needed a "template" to solve his problem. Additionally I was working with Splunk support to get the scripted inputs on Splunk_TA_windows to include MAC address.
The document above asks users to modify system/local which can be very confusing for beginners who want an "app". I dug around on Splunk base and all I could find is my old Wireless service app. Might meet his needs, but doesn't answer the scripted input question.
Anyhow so I hammered this out a quick TA. https://github.com/dpwtheitguy/TA-GetNetAdapter I also uploaded to Splunkbase but it's just so simple they might reject it.
[powershell://GetNetAdapter]
script = Get-NetAdapter | Write-Output
schedule = */5 * * * *
sourcetype=Windows:GetNetAdapter
disabled = 0
Anyhow, for simple PowerShell scripted inputs I hope that app helps.
Comments