Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About michaelstanton
michaelstanton
Explorer
Member since:
07-07-2016
06-05-2020
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 1 |
| Member Since | 07-07-2016 |
Activity Feed
- Got Karma for DUO Log Add-on for Splunk: Why am I getting error "ModularInputs - Validation for scheme=duo failed: The script returned with exit status 1."?. 06-05-2020 12:48 AM
- Posted Re: DUO Log Add-on for Splunk: Why am I getting error "ModularInputs - Validation for scheme=duo failed: The script returned with exit status 1."? on All Apps and Add-ons. 07-22-2016 03:12 PM
- Posted Re: DUO Log Add-on for Splunk: Why am I getting error "ModularInputs - Validation for scheme=duo failed: The script returned with exit status 1."? on All Apps and Add-ons. 07-22-2016 11:59 AM
- Posted Re: DUO Log Add-on for Splunk: Why am I getting error "ModularInputs - Validation for scheme=duo failed: The script returned with exit status 1."? on All Apps and Add-ons. 07-22-2016 06:50 AM
- Posted Re: DUO Log Add-on for Splunk: Why am I getting error "ModularInputs - Validation for scheme=duo failed: The script returned with exit status 1."? on All Apps and Add-ons. 07-21-2016 01:00 PM
- Posted DUO Log Add-on for Splunk: Why am I getting error "ModularInputs - Validation for scheme=duo failed: The script returned with exit status 1."? on All Apps and Add-ons. 07-21-2016 09:26 AM
- Tagged DUO Log Add-on for Splunk: Why am I getting error "ModularInputs - Validation for scheme=duo failed: The script returned with exit status 1."? on All Apps and Add-ons. 07-21-2016 09:26 AM
- Tagged DUO Log Add-on for Splunk: Why am I getting error "ModularInputs - Validation for scheme=duo failed: The script returned with exit status 1."? on All Apps and Add-ons. 07-21-2016 09:26 AM
- Posted Re: used sophos reporting interface with Splunk on Reporting. 07-08-2016 09:30 AM
- Posted Re: used sophos reporting interface with Splunk on Reporting. 07-07-2016 02:27 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 1 |
07-22-2016
03:12 PM
You are exactly right, actually don't see the Admin API as an option. I've contacted Duo about this.
... View more
07-22-2016
11:59 AM
That is where it was located.
I redid the config forcing the app context to the Duo 2FA app and it puts the inputs.conf in \local under the app folder. Shows history = 60 but still nothing populates "C:\Program Files\Splunk\var\lib\splunk\modinputs\duo\" and there are no references to authentication on the duo site. Same kind of outputs in the splunk log showing checkpoint time.
... View more
07-22-2016
06:50 AM
The folder "C:\Program Files\Splunk\var\lib\splunk\modinputs\duo\" exists however it is empty.
What file should be created after the data input configuration? There is no inputs.conf under apps//local/ so not sure where to validate the history setting.
... View more
07-21-2016
01:00 PM
I don't remember exactly. I was searching the _internal logs after installing. Today I walked through the install process again and I don't see that error, basically seeing info messages each time the script runs.
07-21-2016 15:58:16.857 -0400 INFO ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-DUOSecurity2FA\bin\duo.py"" no checkpoint time returned, using history value
07-21-2016 15:58:16.857 -0400 INFO ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\TA-DUOSecurity2FA\bin\duo.py"" Using checkpoint time 1466539096
However not seeing anything within the splunk indexes or in the 'Auth API' log on Duo Admin panel.
... View more
07-21-2016
09:26 AM
1 Karma
I get the following error for the DUO log Add-on for Splunk:
07-20-2016 18:45:36.396 -0400 WARN ModularInputs - Validation for scheme=duo failed: The script returned with exit status 1.
Wondering if this requires Splunk on Linux?
... View more
07-08-2016
09:30 AM
Thanks, yes that would solve it as well.
I figured out that the field actually represents different from UTC in seconds so I added 4 hours to that for EST.
... View more
07-07-2016
02:27 PM
I have an issue where all the threat logs are coming in with the exact same time stamp according to spunk like the "_time" value.
However there are different time stamps within the log like 'inserted time' etc.. that are correct.
This isn't happening for each type.
I'm using the recommendations from the add-on for the inputs.conf but that is configured on a splunk forwarder installed on the enterprise console.
... View more
