I downloaded an app that does exactly what I need to collect BSM audit logs, however it is for version 3.x. I thought I would give it a try and install it anyway, in hopes that it would still work, but it doesnt. The url for the app I have been looking at is here:
http://www.splunkbase.com/apps/All/3.x/Technologies/Security_Applications/OS_Audit_and_Change_Control/app:BSM+Audit+log+loader
After I install it add an apps.conf and run the directions in the readme, I get this error:
$ python bin/bsmping.py --noCache=True
Traceback (most recent call last):
File "bin/bsmping.py", line 9, in <module>
import splunk.clilib.cli_common as comm
ImportError: No module named splunk.clilib.cli_common
I am not familiar enough with python or the changes in splunk from 3.x to 4.x to even know where to start fixing this problem.
Any input is appreciated, thanks!
... View more
