ossec_agent_management.xml

[denisd]

Hi Paul,

This is only a remark.

I had to change this line in the ossec_agent_management.xml to have my OSSEC Server field not empty.

| inputlookup lookup_ossec_servers | search managed=1

else than

| ossecservers managed

I saw many user on the web last few moths that had the same issue.

unable to run data collection??? maybe he have the same

[southeringtonp]

Splunk doesn't seem to like that custom search command when populating the search.

The populating search has been changed in version 1.1.85 of the Splunk for OSSEC app.