BSM Scripted input help

[FrozenGrapes]

I downloaded an app that does exactly what I need to collect BSM audit logs, however it is for version 3.x. I thought I would give it a try and install it anyway, in hopes that it would still work, but it doesnt. The url for the app I have been looking at is here:

http://www.splunkbase.com/apps/All/3.x/Technologies/Security_Applications/OS_Audit_and_Change_Contro...

After I install it add an apps.conf and run the directions in the readme, I get this error:

$ python bin/bsmping.py --noCache=True
Traceback (most recent call last):
  File "bin/bsmping.py", line 9, in <module>
    import splunk.clilib.cli_common as comm
ImportError: No module named splunk.clilib.cli_common

I am not familiar enough with python or the changes in splunk from 3.x to 4.x to even know where to start fixing this problem.

Any input is appreciated, thanks!

[Leo · Accepted solution]

Apparently some referenced libraries are not in the pythonpath environment variable and so python cannot find them.

Try running this script like this: ./splunk cmd python bin/bsmping.py --noCache=True

It will start Python with all environmental variables properly set.

I'm not familiar with the app, but you might need to create a 'bsm' directory under /var/spool/splunk inside your Splunk installation directory. The script requires this path to exist.

[tprzelom]

used for testing the script included with the salesforce TA app

[FrozenGrapes]

This definitely helps, running it with the environment variables worked.