Hello, The reason you are unable to get any data is because you are trying to pull too many results from Security Center at once and the SC API is unable to return that many results. The original app creator must have been working with a very small amount of data. I ran into the same error mesage with my endoffset being over 70,000. To fix this issue, you have to reduce the total records being pulled at one time. I modified the /opt/splunk/etc/apps/tenablesc/bin/sc_connect.py file to pull data in chunks of 5,000. This got my data into splunk. The only downside that I have not fixed is that certain records are not parsed correctly due to additional info being returned (e.g. error_code and timestamp). Here is the code I modified in the sc_connect.py file: def vulnipdetail(self): try: #the first query returns the first 1000 records and the total number of records start, end = 0,1000 input = {"tool": "vulndetails", "startOffset": "0", "endOffset": end , "sourceType": "cumulative"} inputjson = json.dumps(input) data = {"request_id": "1", "module": "vuln", "action": "query", "input": inputjson, "token": self.token} response, content = self.HttpRequest(data) #print the first 1000 records print content result = json.loads(content) total = result['response']['totalRecords'] #this loops through the rest of the records and pulls them in chunks of 5000 while end < int(total): start, end = end, end + 5000 input = {"tool": "vulndetails", "startOffset": start, "endOffset": end, "sourceType": "cumulative"} inputjson = json.dumps(input) data = {"request_id": "1", "module": "vuln", "action": "query", "input": inputjson, "token": self.token} response, content = self.HttpRequest(data) #I tried to concat all the content, but the stdin buffer truncated the results. This causes some records to not be parsed correctly. print content except Exception, e: raise Exception, "Error performing vuln::query::vulndetails : %s" % str(e) ... View more

I found a workaround for this issue. I modified the app's reports so they were looking for action="TCP*". This allowed the dashboards to be populated. I think some of my other apps were causing the problem. ... View more

FYI, this also fixed the same error in the security onion app. thanks! ... View more

I just checked and I do have TA-pfsense installed. http://apps.splunk.com/app/1527/ My understanding was that because the folder name for Splunk on Squid started with a letter 'S' it would have precedence over the TA-pfsense transforms.conf, correct? ... View more

Just so you are aware, I also have the TA-pfsense app installed which might also be trying to parse the squid logs. Thanks! ... View more

The other fields are being extracted properly. I noticed that this query did not work: search sourcetype="squid" action="*" | eval reqcount=1 | timechart per_second(reqcount) by action But this did work: sourcetype="squid" | search action="*" | eval reqcount=1 | timechart per_second(reqcount) by action By adding the search action="*" it was able to query correctly. With this knowledge I could modify the app, but it makes sense to find the root of the issue. ... View more

I was also able to get splunk running on pfsense. Here are some notes to make it easier for the next person who finds this post. use fetch -o instead of wget. FreeBSD does not natively have wget. create the opt directory. Splunk installs to the opt directory by default. mkdir /opt install the package using the FreeBSD pkg_add command pkg_add splunkforwarder... follow the splunk documentation http://docs.splunk.com/Documentation/Splunk/6.1.1/Installation/InstallonFreeBSD ... View more

I ran the search as you recommended, but it states "No matching events found". The clientip field is being extracted by a regex in my transforms.conf file. When I run this command I get the desired results: sourcetype="squid" | top 10 clientip . Any other ideas? Thanks for the help. ... View more

Thanks for pointing that out. It is in fact a typo. I am using transforms.conf. When I run the search commands I am not getting any errors. ... View more

Nevermind, I found the answer here: http://answers.splunk.com/answers/79993/python-sdk-_raw-value-part-missing ... View more

@rgrimsha, I am also getting a truncated _raw field in my results. Did you figure out how to get the full line of text back with the python SDK? It seems the text is truncated after the word in my search query. ... View more