Assuming you've got your java installed and the path setup correctly. Go here: https://javaee.github.io/jaxb-v2/ Download the standalone distribution unzip that directory copy all the .jar files to .../jms_ta/bin/lib/ restart splunk ... View more

Have you checked your permissions? ... View more

These configs worked for me. Can you provide sample data? props.conf [iptest] LOOKUP-check = IP_ranges ip_range AS host OUTPUT range_name [IP_ranges] filename = ips.csv min_matches = 1 default_match = NONE match_type = CIDR(ip_range) fields_list = ip_range, range_name ips.csv ip_range,range_name 10.0.0.0/8,"US Generic One" 10.10.10.0/24,"US Generic Two" ... View more

Missing some required settings per https://answers.splunk.com/answers/305211/how-to-match-an-ip-address-from-a-lookup-table-of.html [IP_Ranges] min_matches = 1 default_match = NONE match_type = CIDR(cidr_range) ... View more

OSquery outputs in json format which is natively understood by Splunk. What version of Splunk are you running? You can try adding a "local" directory to the app(on the search head), create a props.conf file in there and add the following [osqueryd.results] KV_MODE=json ... View more

The dropdowns are populated by searches so either you're not getting data in or it's coming in under the wrong sourcetype. Did you follow the setup instructions from http://osquery.readthedocs.io/en/stable/ ? Is the osquery service running? The packs should be installed on each node you're running osquery on, so that sounds right. Is there anything being written to /var/log/osquery/osqueryd.results.log ? ... View more

Go to the Splunk_TA_nix app directory, this is the other app that comes with the Splunk App for Unix and Linux. Inside it's "bin" directory is plenty of scripts you can use as a template. Including one for the "df" command. ... View more