topic Re: Disabled input methods/scripts throwing errors within Splunk ES in Splunk Enterprise Security

Disabled input methods/scripts throwing errors within Splunk ES

rturk — Wed, 01 Oct 2014 09:15:39 GMT

Hi All,

I have a pretty generic Splunk for Enterprise Security implementation. Every hour I get prompted with a whole bunch of messages such as the ones below:

I believe I have disabled all inputs that call on these binaries and scripts (checked using ./splunk cmd btool inputs list) and yet I still get them... can anyone suggest a possible culprit?

Cheers 🙂 RT

Re: Disabled input methods/scripts throwing errors within Splunk ES

ekost — Wed, 01 Oct 2014 21:28:07 GMT

There was a bug with Windows modular inputs and the Splunk App for Enterprise Security. They were fixed with the releases of Splunk Enterprise 6.0.5 and 6.1.3, and is marked as fixed in the Enterprise Security 3.1 Release Notes under SOLNESS-4629.

Re: Disabled input methods/scripts throwing errors within Splunk ES

rturk — Wed, 01 Oct 2014 22:01:11 GMT

Hi ekost - thanks for that. I should have specified we're running the latest versions of both. I'll log a formal ticket with support today. Thanks again 🙂