topic Re: TA-lastpass does not index any data after setup in Getting Data In

Why does TA-lastpass not index any data after setup?

masonmorales — Fri, 05 May 2023 12:56:28 GMT

Installed per setup instructions @ https://splunkbase.splunk.com/app/2633/#/documentation

SETUP:
Run "setup" under app management from within Splunk either at the time of install or after.
a. Enter your CustomerID as the Username.
b. Enter your apiKey as the password.
c. Enter lastpass as the realm.
Decide if the default index main is acceptable.
If you desire a different index you should.
a. Copy the default/inputs.conf to local/inputs.conf and edit the index field.
Edit bin/lastpass-log.py in the main section to put your LastPass CustomerID into the username field
username = 'ChangeMeTOCustomerID'

No data is indexed.

Re: TA-lastpass does not index any data after setup

masonmorales — Mon, 22 Feb 2016 22:26:12 GMT

Found that lastpass-log.py makes REST calls to https://lastpass.com/enterpriseapi.php

Resolution:
Updated ACLs to allow outbound connections from Splunk server to lastpass.com on TCP 443

@starcher Please add a step for checking network connectivity to lastpass.com over TCP 443 to the Setup Docs.

Re: TA-lastpass does not index any data after setup

starcher — Tue, 23 Feb 2016 14:27:05 GMT

That is correct, you have to allow traffic to services you wish to reach. I'll put a note in the readme next time I touch that project. And I'll try to do that update in a week or so. Thanks!

Re: TA-lastpass does not index any data after setup

masonmorales — Tue, 23 Feb 2016 17:31:16 GMT

Thanks George. A couple other things I ended up doing:

1) Added "#!/usr/bin/env python" before line 1 of lastpass-log.py
2) Make sure SPLUNK_HOME is defined in the OS environment variables (i.e. .bashrc in *nix)

Re: TA-lastpass does not index any data after setup

princemanto2580 — Fri, 05 May 2023 11:53:29 GMT

the file lastpass-log.py not located under bin path.

Even, trying to save the inputs but not showing in UI as it's saved. But in backend inputs.conf showing value saved.