All Apps and Add-ons

BOTS 2.0 scoreboard server setup

ptlopes
Explorer

hello all,

I belong to a SoC ans qe are testing several SIEM Solutions. The best way that we could find to become ourselfs comfortable with Splunk it is the BOTS appoach.

Now, refering to the score app when i follow the steps at https://github.com/splunk/SA-ctf_scoreboard when i get to step 11

Confirm the custom controller came up properly:

ls -l $SPLUNK_HOME/var/log/scoreboard
-rw------- 1 splunk staff 59 Sep 2 14:26 scoreboard.log
-rw------- 1 splunk staff 59 Sep 2 14:26 scoreboard_admin.log

i don't have the *.log files, can you help please

Thank you in advence,
PTL

1 Solution

ndias_splunk
Splunk Employee
Splunk Employee

@skalliger is likely on target with the comment about Splunk versions. Having just went through this myself, I'm going to say it's likely the Splunk version and Python 3 that is biting you. See if you have log entries that look like this:

"ImportError: No module named 'ConfigParser'"

I'm going to guess that you do.

Since you're testing and not version dependent, just install Splunk 7.3.4 and you should be good to go.

https://www.splunk.com/page/previous_releases

View solution in original post

0 Karma

ptlopes
Explorer

Hello Skalli,

Like you said i made the setup with sugested version, Splunk 7.1.1, and everything is working like expected.

Thank you very much for your help,
PTL

ndias_splunk
Splunk Employee
Splunk Employee

Just a thought, if you're planning on using/testing Splunk Enterprise Security with BOTS, you'll need at least Splunk 7.2.8 to work with ES 6.0.

HTH!

0 Karma

skalliger
SplunkTrust
SplunkTrust

Thank you for your feedback. 🙂

ndias_splunk
Splunk Employee
Splunk Employee

@skalliger is likely on target with the comment about Splunk versions. Having just went through this myself, I'm going to say it's likely the Splunk version and Python 3 that is biting you. See if you have log entries that look like this:

"ImportError: No module named 'ConfigParser'"

I'm going to guess that you do.

Since you're testing and not version dependent, just install Splunk 7.3.4 and you should be good to go.

https://www.splunk.com/page/previous_releases

0 Karma

skalliger
SplunkTrust
SplunkTrust

What steps have you done and checked? Did you follow the instructions step by step? That's very important otherwise it's easy to miss a step, like creating the log directory first. Did you copy the default controller config to the correct directory?
Also make sure you're only using the recommended Splunk Enterprise version as newer versions might not be working.

Skalli

ptlopes
Explorer

Hello Skalli,

Thak you for your update. I followed all the steps including the controller config copy. Probably it is because of the splunk version... I installed the latest one 8.0.1.

I will try another one and return feedback

thank you,
PTL

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...