¿Does anyone know what could be happening ? I have been checking this issue and I saw that python 3 lib, especially decoder json function does not recognize the message incoming. I wonder if the message changes between aws to Splunk or Json format is not being created properly. Anyway,  I am receiving events nearly to 12h later. I would like to create a case to aws but I do not know where I can do it.  ... View more

@smitra_splunk Were you able to determine what the problem is? I am seeing the exact same error for a lot of Config log files. ... View more

Thank you @cyrix . This worked for me. ... View more

Posted 2020 I recently deployed this TA and experienced the same issue as in the OP's post.  There is a similarly related issue on Answers that states the error message changed when the OP pointed the TA at a scan engine instead of the management console - This was also true for me (changed to a timeout error). We identified that the user account that was created for us on the Rapid7 asset was configured to force a password reset upon first login.  The repeated attempts were also causing account lockouts in the Rapid7 audit logs and was very telling as to the issue. We disabled the inputs in the Rapid7 TA, reconfigured the user, updated the TA's account configuration and then re-enabled the inputs.  We were able to confirm successful configuration almost instantly. I hope this is helpful for others experiencing the same/similar issues. ... View more

facing same problem ... no clues .... doesn't look like there is a correlation to errors reported by other splunkd logging components. just sudden spikes of SHCFunctions warnings. ... View more

You are right. The docs don't mention the sourcetype either on the inputs.conf or in the collectd.conf. The sourcetype=collectd_http need to mentioned either file - in the former under the HEC input stanza and in the latter as part of the URL in the write_http plugin section. The basic examples only hint at the sourcetype in the curl examples in the document "a beginner's guide to collectd". anyway ... learnt my lesson... I had better success using the Splunk App for Infrastructure which has detailed step by step documentation and integrated install scriptlets of all components. ... View more

Summary of the issue: Splunk 6.0.0 - Splunk 7.2.1 defaults to using init.d when enabling boot start Splunk 7.2.2 - Splunk 7.2.9 defaults to using systemd when enabling boot start Splunk 7.3.0 - Splunk 8.x defaults to using init.d when enabling boot start systemd defaults to prompting for root credentials upon stop/start/restart of Splunk Here is a simple fix if you have encountered this issue and prefer to use the traditional init.d scripts vs systemd. Splunk Enterprise/Heavy Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunk/bin/splunk disable boot-start sudo /opt/splunk/bin/splunk enable boot-start -user splunk -systemd-managed 0 Splunk Universal Forwarder example (note: replace the splunk user below with the account you run splunk as): sudo /opt/splunkforwarder/bin/splunk disable boot-start sudo /opt/splunkforwarder/bin/splunk enable boot-start -user splunk -systemd-managed 0 ... View more

Hi smitra. To set the IA to DEBUG mode, please change INFO to DEBUG in the following locations. bin/ModularInput.py line 55 bin/netskope.py line 21 Let us know if there are any further questions. Thank you, Aplura, LLC ... View more

Users need the list_settings capability. You can create a role with that specific capability and inherit power user role and that should be enough. ... View more

This is what I found and could improve situation by tweaking the code. By default it is configured to check its credentials every 30 secs. Once it is detected then modinput goes down in a not-graceful way leaving many entries in "in-flight".. I changed it to 14400 which means check it every 4hours. - in line 76 below; This reduced the in-flight by 95+ %. etc/apps/Splunk_TA_aws/bin/splunksdc/config.py 74 def has_expired(self): 75 now = time.time() 76 if now - self._last_check > 30: 77 eelf._last_check = now 78 self._has_expired = self._check() ... View more

I'm in a similar situation but the twist is that I need to remove an existing peer from an old cluster and take the peer (and its existing data) to join a new cluster / CM. The peer and its data is not to be modified other than what is required to connect to the new cluster master. Is this the approach to take ? - take peer offline permanently in old cluster, remove peer from old CM, modify server.conf on peer with new master_uri and pass4SymmKey, restart peer to join new cluster. Any recommendations are welcome. Thanks in advance! ... View more

And for assertHaveCommand() the following needs to be updated (line 47 of bin/common.sh from Splunk_TA_nix 6.0.2): # # # /sbin/ is often absent in non-root users' PATH, and we want it for ifconfig(8) PATH=$PATH:/sbin/ Ubuntu needs this, or it wont be able to find the "service" command when Splunk is running as non-root (splunk). # # # Append path to help find commands when running as non-root, as the non-root paths are different PATH=$PATH:/sbin/:/usr/sbin/ It's called from bin/rlog.sh as follows: assertHaveCommand service Cheers, Chris. ... View more

The real problem turned out to be the Timezone setting on the DB connection in DBConnect. It was set to PST which was overriding the UTC timestamp column of the table itself. Events were getting ingested with future dates and the search was not finding the latest events. We set the DB server, the McAfee ePO Server and Splunk to GMT and set the Timzone as GMT on the DB connection on DBConnect as GMT too. Everything worked fine after that. ... View more

I'm working around this bug/glitch/typo in the Cylance TA with modifying the eventtypes.conf with a copy in the local dir. The bigger change will be in the Cylance App which has queries using with mixed sourcetypes - i.e. audit_log and syslog_autid_log etc. I'm going to inform the App developer. ... View more

We've also now updated Splunkbase to reflect this. ... View more

Have the same issue. Did you solve it on your side? @smitra_splunk ... View more

Oh brilliant, thank you. ... View more

You might also find this documentation useful: https://docs.splunk.com/Documentation/Splunk/7.3.1/Viz/PanelreferenceforSimplifiedXML Pay attention to the version number. ... View more

worked!! Thanks. 🙂 ... View more

@smitra_splunk We faced a number of constraints that did not allow use of JSON as a transmission format; the older collectd we used also limited the plug-ins we could use, which meant a few data streams would be missing from those expected by the Splunk Add-on for Linux. This second constraint is of course not a problem if you're doing your own analysis of the data streams. We were also unable to use collectd's write_graphite plug-in. We ended up using collectd's write_csv to "log" the data locally, combined with a Universal Forwarder that processed the logs and sent their events in simulated linux:collectd:graphite sourcetype. The Universal Forwarder uses a network connection to send its data, very much like write_http does, but offers several advantages despite its light footprint: it can tag metadata; it buffers, compresses and secures the data transfers; it can consolidate data; it can handle index-time transformations; and it can even do load balancing (when its data are being consumed by several Splunk indexers). Now, your problem seems to be that collectd is sending empty JSON fields, so my first thought would be to check the collectd configuration. The transmission mode (HEC vs. http vs. TCP vs. UDP) is extremely unlikely to be at fault here. Which collectd plug-ins are you using? ... View more