I just configured this app with information (host, domain id, user, and password) from my network colleague. I can use the app but the Monitor » Host Snapshot dashboard does not seem to run, it just sit there with Search is waiting for input… even though I have specified time window and the host, and clicked the Submit button. Also, a colleague (non-admin) logs in to the app, he is asked to configure the app again. Is the configuration per user?
... View more
That ww9rivers was my old account here -- I lost that and does not know how to get it back. The short answer is no, Splunk does not support this add-on. Cisco has published multiple new versions after I initially posted my question here. However, the latest version (3.6.3) still get this wrong. Below is my fix (tested in production): $ git diff v3.6.3
diff --git a/default/transforms.conf b/default/transforms.conf
index f1f89d8..93334a2 100644
--- a/default/transforms.conf
+++ b/default/transforms.conf
@@ -192,7 +192,7 @@ REGEX = "user_agent":\s*"([^"]+)"
FORMAT = syslog_user_agent::$1
[cisco_asa_log_level_message_id]
-REGEX = %(?:ASA|FTD|FMC)(?:-[A-Za-z]+)?-(?P<log_level>\d+)-(?P<message_id>\d+)
+REGEX = %(?:ASA|FTD|FMC)-(?:.*?-)?(?P<log_level>\d)-(?P<message_id>\d+) Edit: Had to fix the REGEX again to cover more different formats found.
... View more
Thank you for the response. I think you mean `$SPLUNK_HOME/etc/auth/server.pem`. However, we are using a third-party CA signed cert for the server's web UI. So I cannot let Splunk creating a self-signed cert. In our installations, these files are replaced with appropriate certs and key: etc/auth/cacert.pem etc/auth/server.pem etc/auth/splunkweb/cert.pem etc/auth/splunkweb/privkey.pem
... View more
Just did a fresh install of Splunk Enterprise 10.0.3, set up HTTPS with the web service, then installed Splunk DB Connect 4.21. The host runs RHEL 9.7. Java is openjdk 11.0.25 2024-10-15 LTS. Set up and started Splunkd service. Logged in. The Splunk DB Connect app shows a message: The Task Server is currently unavailable. Please check your settings. I have had issues with the "task server" and I have been able to resolve them with proper Java settings. But not this time. I tried to manually run the task server. The bin/server.sh script simply hangs. While that happens, I can find the java process that runs the server.jar but no port 9998 open. Also, in the splunkd.log, this error shows up every few seconds: failed to run task server, error=com.splunk.dbx.exception.HttpConnectionException: An error occurred while processing the HTTP request. So it seems that it is possibly a problem between the task server with the Splnkd service itself? May be on the management port 8089?
... View more