About yarick

yarick · ‎04-05-2022

@bharathnetskope- If you have access to the Tenable Support Portal, there should be a spec. That describes if that is supported. It was not in the version of SC I was using.

yarick · ‎04-05-2022

@VijaySrrie- I have not used this particular app, the same should apply - Check if your app is providing a cacerts bundle OR update version of the same provided on a system-wide level (OS not Splunk).

yarick · ‎03-18-2020

Guys, is anybody else seeing this issue?

yarick · ‎11-04-2019

I would suggest a manual edit or deployment of *NIX App. Using deployment server.

yarick · ‎01-10-2019

If an admin actually started Splunk as root at least once, I would suggest to check permissions on directory $SPLUNK_HOME ( with recursion ), prior to attempting to start Splunk as your user of the limited domain ( in your case, splunk ) ...

yarick · ‎01-03-2019

Perfect, thanks!

yarick · ‎01-03-2019

REST Processor: Failed to fetch REST endpoint uri=https://127.0.0.1:8089/services/alerts/correlationsearches?count=0 from server https://127.0.0.1:8089. Check that the URI path provided exists in the REST API. Unexpected status for to fetch REST endpoint uri=https://127.0.0.1:8089/services/alerts/correlationsearches?count=0 from server=https://127.0.0.1:8089 - Not Found

yarick · ‎11-14-2018

Yes, because it is a pull-type of connection.

yarick · ‎09-12-2018

MAX_EVENTS = <integer> Specifies the maximum number of input lines that Splunk software adds to any event. The software breaks the event after it reads the specified number of lines. 256 lines REF. https://docs.splunk.com/Documentation/Splunk/7.1.2/Data/Configureeventlinebreaking

yarick · ‎08-28-2018

Let's Encrypt was not listed in the cert. Store for the Add-on. I updated the list with this command = cat /etc/ssl/certs/ca-bundle.crt >> /opt/splunk/etc/apps/Splunk_TA_nessus/bin/splunktalib/httplib2/cacerts.txt There may be a solution that is more elegant. For example, to ship updated version of the library, or rely on system libraries. But, that is a much larger discussion. SSL Certificate is validated by the Add-on and operating as expected. This solved my issue.

yarick · ‎08-28-2018

Add-on is configured to obtain data from Tenable nessusd (Nessus) 7.1.3 [build M20120] for Linux Error in logs [SSL: CERTIFICATE_VERIFY_FAILED] certificate verification failed. SSL Connection test New, TLSv1/SSLv3, Cipher is AES128-SHA Server public key is 2048 bit Secure Renegotiation IS supported Compression: NONE Expansion: NONE No ALPN negotiated SSL-Session: Protocol : TLSv1.2 Cipher : AES128-SHA Session-ID: Session-ID-ctx: Master-Key: EFB3E32FE3292430D26CE3BE6B5DF3FB9D6ECE9922687B0ECD51A7B82A31B11342F43CD30A1671FFCE030AE4D047B381 Start Time: 1535474072 Timeout : 300 (sec) Verify return code: 0 (ok) Certificate Authority used for this connection - Lets Encrypt

yarick · ‎04-05-2018

msivill, I have tried to configure splunk-logging-driver-for-docker as you suggested. It worked like a charm. But, it stops working as soon as OpenShift gets added to the mix. Reading OpenShift source code ... got complex and "hairy in a hurry." If anyone has any real-world implementations of the Splulnk App suggested by outcoldman, I would love to hear your thoughts. PM is ok. Y.

yarick · ‎12-15-2017

@bentysontcxn : I am having exact same issue. Have you tried opening a ticket with AWS Support? In addition to error : "Could not connect to the HEC endpoint. Make sure that the certificate and the host are valid." I am also seeing this error a few seconds later : "An internal error occurred when attempting to deliver data. Delivery will be retried; if the error persists, it will be reported to AWS for resolution." EDIT: ACM certificate solved the issue for me.

yarick · ‎08-29-2016

The new Service object seems to run as many searches as your quota allows. I have not seen a need to establish new connection for each thread. What version SDK / Splunk are you using ? Post your specific error, if got one.

Posts	14
Solutions	1
Karma Given	16
Karma Received	3
Member Since	‎08-29-2016

Online Status	Offline
Date Last Visited	‎04-06-2022 10:21 AM

Error on Overview Pane - Failed to fetch REST endp...

Why am I getting a "SSL: CERTIFICATE_VERIFY_FAILED...

Re: Why am I getting a "SSL: CERTIFICATE_VERIFY_FA...

Re: Why am I getting a "SSL: CERTIFICATE_VERIFY_FA...

Re: Splunk AWS TA S3 Access Logs Bugs

Re: Question about configuring the Master Node to ...

Re: Splunk 7.2.2 - systemd - Root privileges requi...

Re: Error on Overview Pane - Failed to fetch REST ...

Error on Overview Pane - Failed to fetch REST endp...

Re: Can I disable the Management Port 8089 in a Li...

Re: Why is my JSON format log getting truncated?

Re: Why am I getting a "SSL: CERTIFICATE_VERIFY_FA...

Why am I getting a "SSL: CERTIFICATE_VERIFY_FAILED...

Re: Install Splunk Universal Forwarder into OpenSh...

Re: AWS Kenisis Data Stream Fails with "Could not ...

Re: Is com.splunk.Service thread safe?

Are you a member of the Splunk Community?