topic Re: Splunk for Microsoft Exchange Application in Getting Data In

Splunk for Microsoft Exchange Application

michaeloleary — Thu, 16 Aug 2012 01:17:45 GMT

Hey Folks,

I'm trying to get the reputation check script running on a mail server at the moment and I'm running into some difficulty. Unfortunately the Dashboard is displaying N/A for the reputation check, I have tried troubleshooting the issue by running the command locally.

*C:\Program Files\SplunkUniversalForwarder\bin>splunk cmd "C:\Program Files\Splun
kUniversalForwarder\etc\apps\fwd_reputation\bin\check_my_reputation.py"
CreateProcess: error 193
couldn't run "C:\Program Files\SplunkUniversalForwarder\etc\apps\fwd_reputation\
bin\check_my_reputation.py": The parameter is incorrect.*

The only configuration change for this script that I can see is that I need to set the IP address of my mail server in reputation.conf file as per the document located at the following:

http://docs.splunk.com/Documentation/MSExchange/latest/DeployMSX/Makeconfigurationchangestomatchyourexistingenvironment

I'm trying to figure out what parameter the script is referring that is causing the script to fail, would anyone know what could be causing this?

Any help you guys can provide would be greatly appreciated.

Regards
Mike

Re: Splunk for Microsoft Exchange Application

ahall_splunk — Thu, 16 Aug 2012 01:49:06 GMT

This is, unfortunately, a known bug that will be fixed in the next version. Go into the $SPLUNK_HOME/etc/apps/TA-SMTP-Reputation/default directory and edit the inputs.conf file - change all referenced for fwd_reputation to TA-SMTP-Reputation (global search and replace). Save the file, then restart your splunk instance.

Re: Splunk for Microsoft Exchange Application

ahall_splunk — Thu, 16 Aug 2012 01:50:20 GMT

Also, note that - per the documentation - you need to run TA-SMTP-Reputation on a Heavy Forwarder - the Universal Forwarder cannot run Python based scripted inputs such as this one. (sorry - just noticed that from your command line).

Re: Splunk for Microsoft Exchange Application

michaeloleary — Mon, 28 Sep 2020 12:16:33 GMT

I'm just looking at the python script I see the following line of code too.

app_path = os.path.join(os.environ["SPLUNK_HOME"], 'etc', 'apps', 'fwd_reputation')

I'm no python programmer but I'm assuming that needs to change as well.

Re: Splunk for Microsoft Exchange Application

ahall_splunk — Thu, 16 Aug 2012 02:06:04 GMT

Yes it does. The genesis is that the TA used to be called fwd_reputation, but we renamed it to follow the standard TA naming scheme, and forgot to update the references. It's already been fixed in the SCM, but I'm doing a bunch of other fixes before I do the next release.

Re: Splunk for Microsoft Exchange Application

michaeloleary — Thu, 16 Aug 2012 03:31:02 GMT

Thanks for the help Adrian, I was able to make the appropriate changes to rectify the issue based on the info you gave 🙂

On another note I can't find the information about the heavy forwarder, I can only assume I'm using an old version of the documentation.

Re: Splunk for Microsoft Exchange Application

ahall_splunk — Thu, 16 Aug 2012 20:39:32 GMT

Noted - I'll get the docs clarified.

Re: Splunk for Microsoft Exchange Application

malmoore — Wed, 22 Aug 2012 23:22:10 GMT

Docs updated.