Getting Data In

TA-lastpass does not index any data after setup

masonmorales
Influencer

Installed per setup instructions @ https://splunkbase.splunk.com/app/2633/#/documentation

SETUP:
Run "setup" under app management from within Splunk either at the time of install or after.
a. Enter your CustomerID as the Username.
b. Enter your apiKey as the password.
c. Enter lastpass as the realm.
Decide if the default index main is acceptable.
If you desire a different index you should.
a. Copy the default/inputs.conf to local/inputs.conf and edit the index field.
Edit bin/lastpass-log.py in the main section to put your LastPass CustomerID into the username field
username = 'ChangeMeTOCustomerID'

No data is indexed.

Tags (1)
0 Karma
1 Solution

masonmorales
Influencer

Found that lastpass-log.py makes REST calls to https://lastpass.com/enterpriseapi.php

Resolution:
Updated ACLs to allow outbound connections from Splunk server to lastpass.com on TCP 443

@starcher Please add a step for checking network connectivity to lastpass.com over TCP 443 to the Setup Docs.

View solution in original post

0 Karma

masonmorales
Influencer

Found that lastpass-log.py makes REST calls to https://lastpass.com/enterpriseapi.php

Resolution:
Updated ACLs to allow outbound connections from Splunk server to lastpass.com on TCP 443

@starcher Please add a step for checking network connectivity to lastpass.com over TCP 443 to the Setup Docs.

View solution in original post

0 Karma

starcher
SplunkTrust
SplunkTrust

That is correct, you have to allow traffic to services you wish to reach. I'll put a note in the readme next time I touch that project. And I'll try to do that update in a week or so. Thanks!

0 Karma

masonmorales
Influencer

Thanks George. A couple other things I ended up doing:

1) Added "#!/usr/bin/env python" before line 1 of lastpass-log.py
2) Make sure SPLUNK_HOME is defined in the OS environment variables (i.e. .bashrc in *nix)

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!