Splunk Enterprise Security

Disabled input methods/scripts throwing errors within Splunk ES

rturk
Builder

Hi All,

I have a pretty generic Splunk for Enterprise Security implementation. Every hour I get prompted with a whole bunch of messages such as the ones below:

alt text

I believe I have disabled all inputs that call on these binaries and scripts (checked using ./splunk cmd btool inputs list) and yet I still get them... can anyone suggest a possible culprit?

Cheers 🙂 RT

0 Karma

ekost
Splunk Employee
Splunk Employee

There was a bug with Windows modular inputs and the Splunk App for Enterprise Security. They were fixed with the releases of Splunk Enterprise 6.0.5 and 6.1.3, and is marked as fixed in the Enterprise Security 3.1 Release Notes under SOLNESS-4629.

rturk
Builder

Hi ekost - thanks for that. I should have specified we're running the latest versions of both. I'll log a formal ticket with support today. Thanks again 🙂

0 Karma
Get Updates on the Splunk Community!

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...

Stay Connected: Your Guide to February Tech Talks, Office Hours, and Webinars!

💌Keep the new year’s momentum going with our February lineup of Community Office Hours, Tech Talks, ...