All Apps and Add-ons

Why is the Splunk Add-on for Unix and Linux not producing data in lastlog events?

shbagautdinov
Path Finder

Hello, Splunkers!

I use splunk_TA_nix and this search does not give results. lastlog.sh permissions 754.
Who.sh does not show any data too.
Splunkd is running by root account on CentOS 7.
Is it true that this search must show info about last login of all accounts in each event?
alt text

0 Karma
1 Solution

shbagautdinov
Path Finder

Ok, thanks to all, I have the answer 😃
Yes, when Splunk_TA_nix is properly installed it shows info about lastlogin in each event.
I have done 2 steps to resolve my issue:
1) I have set 755 permissions to all .sh scripts in Splunk_TA_nix
2) And the most important thing I have installed and enabled Splunk_TA_nix on my Windows Search head (In inputs.conf all stanzas must be disabled. It is by default. Do not change this default setting).

View solution in original post

shbagautdinov
Path Finder

Ok, thanks to all, I have the answer 😃
Yes, when Splunk_TA_nix is properly installed it shows info about lastlogin in each event.
I have done 2 steps to resolve my issue:
1) I have set 755 permissions to all .sh scripts in Splunk_TA_nix
2) And the most important thing I have installed and enabled Splunk_TA_nix on my Windows Search head (In inputs.conf all stanzas must be disabled. It is by default. Do not change this default setting).

Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...