Using the details in the cisco umbrella add-on for splunk. The pull-umbrella-logs.sh runs fine manually as the user, splunk. The sync will connect and pull logs with no issue. However, when left to run automated via splunk local inputs.conf. It cannot connect and fails to ingest any data. Splunkd log entry:
ERROR ExecProcessor - message from "/opt/splunk/etc/apps/TA-cisco_umbrella/bin/pull-umbrella-logs.sh" fatal error: Could not connect to the endpoint URL
As far as I can tell, splunk should be the using the same user (splunk) in order to run the script automatically. What might I be missing?