All Apps and Add-ons
Highlighted

Linux Auditd: Predict command error

New Member

I am trying to use the auditd app for Splunk and one of the errors that are thrown is "command="predict", data is not periodic" when trying to generate the Anomalous Event Volume portion of the Security Operations Center dashboard.
Does anyone have any solutions for this?

0 Karma
Highlighted

Re: Linux Auditd: Predict command error

SplunkTrust
SplunkTrust

Hi @jm255,

Are you still receiving this error? It sounds like either the app hasn't yet been configured [correctly] or sufficient auditd events haven't yet been ingested. To confirm that to be the case, please run this search back 24hrs: [|inputlookup auditdindices] [|inputlookup auditdsourcetypes]

If the search above doesn't return events, please ensure you've completed the installation configuration: https://github.com/doksu/splunk_auditd/wiki/Installation-and-Configuration

0 Karma