Splunk Enterprise Security

Splunk ES 6.1.1 asset_lookup_by_cidr not populated

kwasielewski
Path Finder

We are validating our Splunk 6.1.1 ES installation and have noticed the "asset_lookup_by_cidr" kvstore based lookup data is not being populated.  Looks like ES 6.1.1 now runs a python script module in a input process to extract the data from our assets file then into the kvstore for further processing.  It's not working and i am struggling to figure out how to troubleshoot the the python modular approach to this extraction. 

Any idea where I can look for issues?  Here are some of the items I have already checked.

1.  Our asset data does include the ip field with entries containing subnet masks.  Like 127.0.0.1/32 .

2. Running the original 5.x correlation query which used to populate the "asset_lookup_by_cidr" table produces results.  This leads me to believe the data is in good shape.

3. A review of the _internal logs is not showing any python scripting errors from the modules that I have noticed.

Thank you,

Ken

 

 

Tags (1)
0 Karma
1 Solution

jwelch_splunk
Splunk Employee
Splunk Employee

/32 will not help you here because we interpret that as one (1) ip address.... Something like 127.0.0.0/8 would work here.

 

If you have other data in your source files that is something other than a /32 or a format in the following:

https://docs.splunk.com/Documentation/ES/6.2.0/Admin/Formatassetoridentitylist#Asset_lookup_fields

Look at the IP field example.

 

Then you might be having an issue.  I would suggest you start with the identity_manager.log to see what is going on here.  If you have more information please provide it and I will try and help you out.

 

Okie

View solution in original post

jwelch_splunk
Splunk Employee
Splunk Employee

/32 will not help you here because we interpret that as one (1) ip address.... Something like 127.0.0.0/8 would work here.

 

If you have other data in your source files that is something other than a /32 or a format in the following:

https://docs.splunk.com/Documentation/ES/6.2.0/Admin/Formatassetoridentitylist#Asset_lookup_fields

Look at the IP field example.

 

Then you might be having an issue.  I would suggest you start with the identity_manager.log to see what is going on here.  If you have more information please provide it and I will try and help you out.

 

Okie

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...