Getting Data In

How to connect Splunk API with Trend Micro Apex One aaS?



I try onboarding several Trend Micro Cloud Applications like Apex One as a Service but it just doesn't work. 

On the Apex One Cloud Platform I can get the URL, Application ID and API Key necessary to connect. 


but it doesn't seem to work. I get the following errors in the apex_one_as_a_service_api.log : 

2021-11-12 09:56:08,859 DEBUG pid=105063 tid=MainThread | "GET /WebApp/api/v1/Logs/officescan_virus?output_format=CEF&page_token=0&since_time=1636707248 HTTP/1.1" 404 1245



2021-11-12 10:00:08,804 ERROR pid=122037 tid=MainThread | Get error when collecting events. Traceback (most recent call last): File "/opt/splunk/etc/apps/Apex-One-as-a-Service/bin/apex_one_as_a_service/aob_py3/modinput_wrapper/", line 128, in stream_events self.collect_events(ew) File "/opt/splunk/etc/apps/Apex-One-as-a-Service/bin/", line 64, in collect_events input_module.collect_events(self, ew) File "/opt/splunk/etc/apps/Apex-One-as-a-Service/bin/", line 91, in collect_events r_json = response.json() File "/opt/splunk/etc/apps/Apex-One-as-a-Service/bin/apex_one_as_a_service/aob_py3/requests/", line 897, in json return complexjson.loads(self.text, **kwargs) File "/opt/splunk/lib/python3.7/json/", line 348, in loads return _default_decoder.decode(s) File "/opt/splunk/lib/python3.7/json/", line 337, in decode obj, end = self.raw_decode(s, idx=_w(s, 0).end()) File "/opt/splunk/lib/python3.7/json/", line 355, in raw_decode raise JSONDecodeError("Expecting value", s, err.value) from None json.decoder.JSONDecodeError: Expecting value: line 1 column 1 (char 0) 


splunkd.log itself says the same: 

11-12-2021 10:02:08.931 +0100 ERROR ExecProcessor - message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/Apex-One-as-a-Service/bin/" ERRORExpecting value: line 1 column 1 (char 0)


I'm trying to use the following app for it:


What is wrong? does anyone know how to make this work? 

PS: I'm sorry I can't use the "insert code" function here since it throws errors when I try. 


Labels (1)
Tags (2)
0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...