All Apps and Add-ons

How to troubleshoot why no SCM data is ingesting in splunk for tripwire addon?

djoshi2
Engager

I am using Tripwire Enterprise Add-on for Splunk. to retrieve data using either SOAP or REST. I have tried both the methods. I see data coming in for te_FIM_csv and te_assets.csv. I see the file DTR-hist.csv created under /opt/teexports but it only has header in it. I have checked the REST API and results for policies,waivers exist on the TE console.

I also looked at tripwire_scm.py script, it's pulling from https://Ip_address/api/v1/policytestresults endpoint. That endpoint has no values in it. Is that why we aren't pulling any SCM data?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!