the question about Tripwire Enterprise App for Splunk Enterprise

[xsstest]

tripwire-enterprise-add-on-for-splunk APP After installation is complete, prompts the error when searching:

The lookup table 'asset_info' does not exist.It is referenced by configuration 'te_fim_scv
The lookup table 'asset_info' does not exist.It is referenced by configuration 'te_scm_scv

." So I executed the script te_assets.py In the directory / TA_tripwire_enterprise / lookups /. Also prompted the error:

 ImportError: No module named splunk.clilib. 

Where does the splunk.clilib module come from? can I download it from which link?

[msocops]

Hi Jim,

Found this thread, as I am facing an issue with Tripwire, on splunk. It is generating this humongous file ( te_assets.csv ) approximately 26 GB within an hour. Due to this the splunk service stops as in the Search Head there is only a single partition.

Seems like Tripwire keeps updating splunk lookup with a fresh copy of assets data. Is there a way to limit the generated lookup file on Splunk? Or any config changes to be done from Tripwire Side?

Your help/feedback is highly appreciated.

[JimWachhaus]

The error you’re seeing is because the lookup table asset_info doesn’t exist on the splunk system that you’re using to view your dashboards. This lookup table would appear as te_assets.csv in TA_tripwire_enterprise/lookups.

The TA will automatically retrieve asset data from TE and write te_assets.csv out to disk if you enable the input on that splunk instance. To do that you can enable the “$SPLUNK_HOME/etc/apps/TA_tripwire_enterprise/bin/te_assets.py” Script input from the Settings -> Data Inputs -> Scripts section of the UI.

Alternatively you can add “disabled = 0” to TA_tripwire_enterprise/local/inputs.conf underneath the [script://$SPLUNK_HOME/etc/apps/TA_tripwire_enterprise/bin/te_assets.py] section and restart splunk.

Once TA_tripwire_enterprise/lookups/te_assets.csv exists, the error you’re seeing should go away.