All Apps and Add-ons

How to troubleshoot why no SCM data is ingesting in splunk for tripwire addon?

djoshi2
Engager

I am using Tripwire Enterprise Add-on for Splunk. to retrieve data using either SOAP or REST. I have tried both the methods. I see data coming in for te_FIM_csv and te_assets.csv. I see the file DTR-hist.csv created under /opt/teexports but it only has header in it. I have checked the REST API and results for policies,waivers exist on the TE console.

I also looked at tripwire_scm.py script, it's pulling from https://Ip_address/api/v1/policytestresults endpoint. That endpoint has no values in it. Is that why we aren't pulling any SCM data?

0 Karma
Get Updates on the Splunk Community!

Celebrating Fast Lane: 2025 Authorized Learning Partner of the Year

At .conf25, Splunk proudly recognized Fast Lane as the 2025 Authorized Learning Partner of the Year. This ...

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...