Search
  • danielpwilson

Get-NetAdapter PowerShell Scripted Input

Updated: Apr 18, 2020

Just hanging out on Facebook today and I noticed this post.



Honestly this isn't the the first time I've seen this exact question. Powershell scripting in Splunk is little weird and while there are docs https://docs.splunk.com/Documentation/Splunk/8.0.2/Data/MonitorWindowsdatawithPowerShellscripts


I felt it wasn't enough to leave this requester with a link and move on. He needed a "template" to solve his problem. Additionally I was working with Splunk support to get the scripted inputs on Splunk_TA_windows to include MAC address.

The document above asks users to modify system/local which can be very confusing for beginners who want an "app". I dug around on Splunk base and all I could find is my old Wireless service app. Might meet his needs, but doesn't answer the scripted input question.

https://splunkbase.splunk.com/app/3263/

Anyhow so I hammered this out a quick TA. https://github.com/dpwtheitguy/TA-GetNetAdapter I also uploaded to Splunkbase but it's just so simple they might reject it.



[powershell://GetNetAdapter]  
  script = Get-NetAdapter | Write-Output  
  schedule = */5 * * * *  
  sourcetype=Windows:GetNetAdapter  
  disabled = 0



Anyhow, for simple PowerShell scripted inputs I hope that app helps.

20 views0 comments

Recent Posts

See All

How do I learn Splunk administration?

Had an old coworker hit me up a week ago. He took a job as a SOC analyst where part of his job is going to be supporting Splunk. He's a smart guy but Splunk is more complex than it looks. Given I've a