Why does TA-lastpass not index any data after setup?

[masonmorales]

Installed per setup instructions @ https://splunkbase.splunk.com/app/2633/#/documentation

SETUP:
Run "setup" under app management from within Splunk either at the time of install or after.
a. Enter your CustomerID as the Username.
b. Enter your apiKey as the password.
c. Enter lastpass as the realm.
Decide if the default index main is acceptable.
If you desire a different index you should.
a. Copy the default/inputs.conf to local/inputs.conf and edit the index field.
Edit bin/lastpass-log.py in the main section to put your LastPass CustomerID into the username field
username = 'ChangeMeTOCustomerID'

No data is indexed.

[masonmorales · Accepted solution]

Found that lastpass-log.py makes REST calls to https://lastpass.com/enterpriseapi.php

Resolution:
Updated ACLs to allow outbound connections from Splunk server to lastpass.com on TCP 443

@starcher Please add a step for checking network connectivity to lastpass.com over TCP 443 to the Setup Docs.

[starcher]

That is correct, you have to allow traffic to services you wish to reach. I'll put a note in the readme next time I touch that project. And I'll try to do that update in a week or so. Thanks!

[masonmorales]

Thanks George. A couple other things I ended up doing:

1) Added "#!/usr/bin/env python" before line 1 of lastpass-log.py
2) Make sure SPLUNK_HOME is defined in the OS environment variables (i.e. .bashrc in *nix)

[princemanto2580]

the file lastpass-log.py not located under bin path. 

Even, trying to save the inputs but not showing in UI as it's saved. But in backend inputs.conf showing value saved.