When I enable/disable the input it pulls in new events, but it throws the below errors.
If I leave it enabled and it stops pulling in logs after the first attempt.
ERROR:
/splunk/etc/apps/sft-audit-events-splunk/bin/app/node_modules/async/dist/async.js:473:16
/splunk/etc/apps/sft-audit-events-splunk/bin/app/sft-audit-events.js:215:72
/splunk/etc/apps/sft-audit-events-splunk/bin/sft-audit-events.sh" Logger.info(INPUT_NAME, "Got events: " + results.getAndEmitEvents.list.length
"Dependencies This modular input
depends on a couple of npm modules:
1. request - Apache 2.0
2. async - MIT
3. splunk-sdk - Apache 2.0
4. parse-link-header - MIT"
Hi @cybersecnutant ,
Did you have a chance to check out @richgalloway 's answer? If it worked, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help you.
Thanks for posting!
Talk to your Linux system admin about installing the dependencies. Give him/her the links from the splunkbase page. Don't forget to have him/her install NodeJS, too.