- Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: Splunk for Asset Discovery: How to troubleshoo...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm trying to get Splunk for Asset Discovery working. The scripts work fine from the command line, and Splunk is running as root so it should work. However, there are no results and I cannot tell if the script is running. Can anyone help point me in the right direction?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi chrislibby,
like in the docs of the app written you have to change line 111 of nmap.sh to be like this:
nmap $nargs $target #2>/dev/null
to get nmap errors. Also check for errors related to the script in splunkd.log
index=_internal nmap.sh
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi chrislibby,
like in the docs of the app written you have to change line 111 of nmap.sh to be like this:
nmap $nargs $target #2>/dev/null
to get nmap errors. Also check for errors related to the script in splunkd.log
index=_internal nmap.sh
cheers, MuS
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That lead me to these errors, which adding "unset LD_LIBRARY_PATH" fixed.
12-21-2015 09:44:32.005 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/asset_discovery/bin/nmap.sh" nmap: /opt/splunk/lib/libssl.so.1.0.0: version `OPENSSL_1.0.0' not found (required by nmap)
12-21-2015 09:44:32.004 -0500 ERROR ExecProcessor - message from "/opt/splunk/etc/apps/asset_discovery/bin/nmap.sh" nmap: /opt/splunk/lib/libcrypto.so.1.0.0: version `OPENSSL_1.0.0' not found (required by nmap)
https://answers.splunk.com/answers/105439/no-port-scan-data.html
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If this solved your problem and answered your question, please accept the answer - thanks 🙂
Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...
Troubleshooting the OpenTelemetry Collector
Adoption of Infrastructure Monitoring at Splunk
