Splunk Add-on for Akamai: Why am I not getting an data when I implement TA_Akamai_SIEM integration?

[anzianojackson]

I've been trying to figure this out for a bit now. I've installed the TA_Akamai_SIEM_1.2.0 to ingest Akamai Kona WAF logs. I have tested the REST API via command line to pull SIEM data, but when I trying to implement it with the Splunk Add-on, no data comes back.

Error Message from UI:

Unable to initialize modular input "TA-Akamai_SIEM" defined inside the app "TA-Akamai_SIEM": Introspecting scheme=TA-Akamai_SIEM: script running failed (exited with code 127).

I'm running this on a 6.5.3 forwarder.

[end_es]

is anyone know how to disable this input?

[cpetterborg]

Where is the input defined? You should be able to disable it where it is defined.

If you have access to the command line on the machine, do:

splunk btool inputs list --debug | fgrep "<the input name>"

 Where the input is defined, you can go to the config file and delete the input, or disable it.

[Karthikeya]

@cpetterborg @anzianojackson @adri2915 @iamarkaprabha please help on this similar issue - https://community.splunk.com/t5/Getting-Data-In/Akamai-add-on-logs-are-not-populating/m-p/743241#M11...

[cpetterborg · Accepted solution]

This is probably caused by java not being installed on the server.

[Karthikeya]

@cpetterborg can you please help me how to install Java on our Splunk instance? 

[cpetterborg]

It is highly reliant on what your servers are like, but here is a google search that might help you to install Java on various systems for Splunk:

https://www.google.com/search?q=site%3Asplunk.com+install+java&sca_esv=2e83ef3dd22d1d30&sxsrf=AHTn8z...

[anzianojackson]

I heart you so much!

[iamarkaprabha]

Hi ,

Yes cpetterborg is correct. I had faced the same issue while integrating Akamai and splunk. The main issue is Java path. The shell script was not able to execute the jar due to java path issue

[adri2915]

Hello, please, you could say, how resolve this problem? what do you actions you applicated? 

Thank you