topic Re: BSM Scripted input help in Getting Data In

BSM Scripted input help

FrozenGrapes — Fri, 04 Jun 2010 03:29:30 GMT

I downloaded an app that does exactly what I need to collect BSM audit logs, however it is for version 3.x. I thought I would give it a try and install it anyway, in hopes that it would still work, but it doesnt. The url for the app I have been looking at is here:

http://www.splunkbase.com/apps/All/3.x/Technologies/Security_Applications/OS_Audit_and_Change_Control/app:BSM+Audit+log+loader

After I install it add an apps.conf and run the directions in the readme, I get this error:

$ python bin/bsmping.py --noCache=True
Traceback (most recent call last):
  File "bin/bsmping.py", line 9, in <module>
    import splunk.clilib.cli_common as comm
ImportError: No module named splunk.clilib.cli_common

I am not familiar enough with python or the changes in splunk from 3.x to 4.x to even know where to start fixing this problem.

Any input is appreciated, thanks!

Re: BSM Scripted input help

Leo — Fri, 04 Jun 2010 04:40:54 GMT

Apparently some referenced libraries are not in the pythonpath environment variable and so python cannot find them.

Try running this script like this: ./splunk cmd python bin/bsmping.py --noCache=True

It will start Python with all environmental variables properly set.

I'm not familiar with the app, but you might need to create a 'bsm' directory under /var/spool/splunk inside your Splunk installation directory. The script requires this path to exist.

Re: BSM Scripted input help

FrozenGrapes — Fri, 04 Jun 2010 06:00:42 GMT

This definitely helps, running it with the environment variables worked.

Re: BSM Scripted input help

tprzelom — Tue, 27 May 2014 15:46:18 GMT

used for testing the script included with the salesforce TA app