Splunk Add-on for Symantec Endpoint Security: Configuring the TA to update the Malware Category Lookup results in "...could not find a related app.conf file"

[adamblock2]

I have the Splunk_TA-symantec-ep installed on both of our Search Heads. Although I had enabled automatic update of the malware categories, I checked the timestamp of the lookup files, and they have not been updated. I then found that when I attempt to configure the TA to automatically update the malware category lookup table, the following appears in /opt/splunk/var/log/splunk/web_service.log of the Search Head:

WARNING [562e6f6c727fd4305b8ed0] view:152 - Splunk cannot load app "Splunk_TA_symantec-ep" because it could not find a related app.conf file.

I looked in both /opt/splunk/etc/apps/Splunk_TA_symantec-ep/default and /opt/splunk/etc/apps/Splunk_TA_symantec-ep/local, and there is an app.conf file.

Assistance with this would be appreciated.

Thank you.

[woodcock]

Try manually setting your file permissions and ownership from the command line to match the user that is running the splunk instance.

[rpille_splunk]

Hi Adam,
The package on Splunkbase definitely has an app.conf file in the default folder, so perhaps it got lost somehow. You can download the package again to get the file.
Thanks!
~ Robin

[adamblock2]

The app.conf file is present in both the default and local folders on both of my search heads. Would re-downloading and re-installing change anything?