All Apps and Add-ons

Umbrella Cisco-managed s3 bucket sync only working manually

phamanth
Explorer

Using the details in the cisco umbrella add-on for splunk.  The pull-umbrella-logs.sh runs fine manually as the user, splunk.  The sync will connect and pull logs with no issue.  However, when left to run automated via splunk local inputs.conf.  It cannot connect and fails to ingest any data.  Splunkd log entry:

ERROR ExecProcessor - message from "/opt/splunk/etc/apps/TA-cisco_umbrella/bin/pull-umbrella-logs.sh" fatal error: Could not connect to the endpoint URL

As far as I can tell, splunk should be the using the same user (splunk) in order to run the script automatically.  What might I be missing?

 

Labels (1)
0 Karma
1 Solution

phamanth
Explorer

Figured it out.  Silly mistake of forgetting about script running in a different shell that may or may not have environmental variables for proxy.

View solution in original post

0 Karma

phamanth
Explorer

Figured it out.  Silly mistake of forgetting about script running in a different shell that may or may not have environmental variables for proxy.

0 Karma

rajashaey
Engager

Do you know what is the frequency of arriving umbrella dns logs into s3 bucket?

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...