All Apps and Add-ons

What settings are needed to run the Splunk Add-on for Check Point OPSEC LEA in 6.4.1 on Red Hat Enterprise Linux 7?

pinVie
Path Finder

Hi,

Is anybody running the Splunk Add-on for Check Point OPSEC LEA on RHEL 7?
If so, are there special settings or the like that have to be done?

Thank you !

0 Karma
1 Solution

javiergn
SplunkTrust
SplunkTrust

We are.
No issues so far. I know it's not meant to be fully supported by the current version of the App (3.1.0), but it's not causing any issues.
Keep in mind it won't work with Splunk 6.4 or above.

The new release of the App is supposed to be coming out soon so RHEL 7 might be fully supported then (and also Splunk 6.4 and above).

View solution in original post

javiergn
SplunkTrust
SplunkTrust

We are.
No issues so far. I know it's not meant to be fully supported by the current version of the App (3.1.0), but it's not causing any issues.
Keep in mind it won't work with Splunk 6.4 or above.

The new release of the App is supposed to be coming out soon so RHEL 7 might be fully supported then (and also Splunk 6.4 and above).

pinVie
Path Finder

Thank you for this information - I installed it some minutes ago and get this error "custom:199 - cannot load specified module remote in app Splunk_TA_opseclea_linux22: /opt/splunk/lib/python2.7/site-packages/M2Crypto/__m2crypto.so: undefined symbol: SSLv2_method"

I thought that this might be related to the fact that we are using RHEL 7 but it seems that it is a different reason.

0 Karma

javiergn
SplunkTrust
SplunkTrust

Are you running Splunk 6.4?
If so, you need to downgrade to 6.3 because python in 6.4 doesn't work with OPSEC LEA.

This will be fixed in the next release of OPSEC LEA app

pinVie
Path Finder

Yes I am running 6.4.1.
Thank you for this hint !!!!! 🙂

0 Karma

javiergn
SplunkTrust
SplunkTrust

I had exactly the same problem 3 weeks ago so still fresh 😄

0 Karma

javiergn
SplunkTrust
SplunkTrust

By the way, if this works for you don't forget to mark it as answered so that others can benefit from it

0 Karma

pinVie
Path Finder

Done - it is working 🙂

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...