topic Re: Asset Discovery App in All Apps and Add-ons

Asset Discovery App

rmsit — Mon, 28 Apr 2014 12:42:16 GMT

Hi, all. I just installed the Asset Discovery App in Splunk and really like it, however, I'm having issues in my Windows environment. I understand the app is not supported by Splunk and I'm looking for a similar (free) app that is Splunk supported. Any suggestions? Thanks.

Re: Asset Discovery App

richgalloway — Mon, 28 Apr 2014 12:54:35 GMT

What issues are you having? Perhaps someone here can help resolve them.

Re: Asset Discovery App

rmsit — Mon, 28 Apr 2014 13:02:26 GMT

Thank you for responding. I’m trying to pass the -iL argument in the scripted input to use a file with target IP addresses so I do not have to list all of them in the scripted input. Also, I receive the warning "'stats' command: limit for values of field 'status' reached. Some values may have been truncated or ignored." on the overview screen and status changes are not showing. Lastly, I edited the VB script arguments to include the -sc and not -sV discovery options since -sV is not supported on nmap 6.45 so ping scans are executed.

Re: Asset Discovery App

mw — Mon, 28 Apr 2014 14:20:39 GMT

Hello rmsit, I'm the author of that app and I'd be happy to work on this issue with you. Strictly speaking, editing of the vb script shouldn't be necessary. If you pass arguments in they should override the defaults such as -sV. Regarding the -iL argument: could you please post your relevant input stanza?

Also, if you run the search:

index=_internal sourcetype=splunkd asset_discovery error

I'd be curious to know if there is any error output.

Re: Asset Discovery App

rmsit — Mon, 28 Sep 2020 16:28:56 GMT

I tested the script (with -sc) manually from the command line and received the expected results so that works. Scripted inputs are:

[script://D:\Program Files\Splunk\etc\apps\asset_discovery\bin\nmap.cmd -t "list of IPs"
disabled = false
index = asset_discovery
interval = 300
source = nmap
sourcetype = ping_scan

[script://D:\Program Files\Splunk\etc\apps\asset_discovery\bin\nmap.cmd -t -O "list of IPs"
disabled = false
index = asset_discovery
interval = 14400
source = nmap
sourcetype = port_scan

Running nmap.cmd -iL "file" did not seem to work. No errors running the search you provided.

Re: Asset Discovery App

rmsit — Mon, 28 Apr 2014 14:38:29 GMT

I have two Splunk 6.0.3 servers, 1 is deployment/indexer and 1 a search head running Windows 2008 Ent. R2 64bit. Asset Discovery app is installed on search head. I'm receiving data, just UP/Down states are not showing and issue with nmap -iL command.

Thank you for looking into this.

Re: Asset Discovery App

mw — Mon, 28 Apr 2014 14:46:35 GMT

I don't see an input that contains the "-iL" argument. Do the inputs listed work as expected? What happens when you attempt to use the "-iL" argument exactly?

Re: Asset Discovery App

mw — Mon, 28 Apr 2014 14:53:13 GMT

Also, the two inputs you've specified are effectively the same -- both will perform full port scans, the one just includes OS fingerprinting. The ping scan definition should probably have some arguments to concentrate just on system availability.

Re: Asset Discovery App

rmsit — Mon, 28 Apr 2014 14:55:37 GMT

When telling nmap to use a file via input script, no results are available. I resorted to listing all of the target IPs as a workaround and removed the input containing the "-iL" argument. Also, to correct my oringal post, I edited the script to use "-sn" and not "-sc" for ping scans.

Re: Asset Discovery App

Waltersr24 — Wed, 01 Feb 2017 20:27:02 GMT

i'm having trouble with getting anything into the app. I'm pretty new to Splunk and would really like to use this app for my network.