Getting Data In

BSM Scripted input help

FrozenGrapes
New Member

I downloaded an app that does exactly what I need to collect BSM audit logs, however it is for version 3.x. I thought I would give it a try and install it anyway, in hopes that it would still work, but it doesnt. The url for the app I have been looking at is here:

http://www.splunkbase.com/apps/All/3.x/Technologies/Security_Applications/OS_Audit_and_Change_Contro...

After I install it add an apps.conf and run the directions in the readme, I get this error:

$ python bin/bsmping.py --noCache=True
Traceback (most recent call last):
  File "bin/bsmping.py", line 9, in <module>
    import splunk.clilib.cli_common as comm
ImportError: No module named splunk.clilib.cli_common

I am not familiar enough with python or the changes in splunk from 3.x to 4.x to even know where to start fixing this problem.

Any input is appreciated, thanks!

Tags (2)
0 Karma
1 Solution

Leo
Splunk Employee
Splunk Employee

Apparently some referenced libraries are not in the pythonpath environment variable and so python cannot find them.

Try running this script like this: ./splunk cmd python bin/bsmping.py --noCache=True

It will start Python with all environmental variables properly set.

I'm not familiar with the app, but you might need to create a 'bsm' directory under /var/spool/splunk inside your Splunk installation directory. The script requires this path to exist.

View solution in original post

Leo
Splunk Employee
Splunk Employee

Apparently some referenced libraries are not in the pythonpath environment variable and so python cannot find them.

Try running this script like this: ./splunk cmd python bin/bsmping.py --noCache=True

It will start Python with all environmental variables properly set.

I'm not familiar with the app, but you might need to create a 'bsm' directory under /var/spool/splunk inside your Splunk installation directory. The script requires this path to exist.

tprzelom
Path Finder

used for testing the script included with the salesforce TA app

0 Karma

FrozenGrapes
New Member

This definitely helps, running it with the environment variables worked.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...