Skip to content

Splunk Add-on for PowerShell provides field extraction for PowerShell event logs.

License

Notifications You must be signed in to change notification settings

swisscom/splunk-addon-powershell

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

9 Commits
 
 
 
 
 
 
 
 

Repository files navigation

Splunk Add-on for PowerShell

The Splunk Add-on for PowerShell provides field extraction for PowerShell event logs. Unfortunately, PowerShell logs are in system language which requires field extraction for each language. Furthermore, delimiters are sometimes : and sometimes =.

Currently supported languages are

  • English
  • French
  • Italian
  • German

Prerequisites

Collection of Microsoft-Windows-PowerShell/Operational event logs.

Installation

Add the folder "ta-microsoft-powershell" to a ZIP and upload it to https://spunkserver/en-US/manager/appinstall/_upload.

Sourcetypes

Following source is used for field extraction.

source="XmlWinEventLog:Microsoft-Windows-PowerShell/Operational" 

Changelog

See changelog in the add-on.

Contribution

File an issue or submit a pull request.

About

Splunk Add-on for PowerShell provides field extraction for PowerShell event logs.

Topics

Resources

License

Stars

Watchers

Forks