All Apps and Add-ons

How to Linux Auditd: Predict command error

jm255
New Member

I am trying to use the auditd app for Splunk and one of the errors that are thrown is "command="predict", data is not periodic" when trying to generate the Anomalous Event Volume portion of the Security Operations Center dashboard.
Does anyone have any solutions for this?

0 Karma

doksu
Contributor

Hi @jm255,

Are you still receiving this error? It sounds like either the app hasn't yet been configured [correctly] or sufficient auditd events haven't yet been ingested. To confirm that to be the case, please run this search back 24hrs: [|inputlookup auditd_indices] [|inputlookup auditd_sourcetypes]

If the search above doesn't return events, please ensure you've completed the installation configuration: https://github.com/doksu/splunk_auditd/wiki/Installation-and-Configuration

0 Karma

Arjan
Loves-to-Learn

Hi doksu, I installed your app auditd but the searches fail. This search |inputlookup auditd_indices and | inputlookup auditd_sourcetypes are working correctly but [|inputlookup auditd_sourcetypes] search is not returning any result. And the data is in the right index and sourcetype. Do you know how I can fix this?

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...