About scottsavarese

scottsavarese · ‎11-19-2020

I'm writing an alert action custom app. However the embedded python3 will not let me use a required library that has a compiled C library in it (.so file). /opt/splunk/bin/python3 for some reason won't link it. Is there a way to tell Splunk's (I'm on splunk 8.1.0) to load the compiled C libraries? That would be the best way. I noticed that the system /usr/bin/python3 works just fine. How do I tell Splunk to use that in my alert action script conf file or the script itself? I have `splunk.version=python3` in the config file and I've tried both '#!/usr/bin/python3' and '#!/usr/bin/env python3' at the top of my script. I'm thinking that I may need to write a shell script shim that simply calls my script the right way. But I'd like to avoid that if possible (not even sure it would work in the newer versions of Splunk. Thanks!

scottsavarese · ‎01-09-2019

See the conversation with harsmarvania57. I'm actually able to set idpCertPath to something outside of etc/auth with some caveats.

scottsavarese · ‎01-09-2019

I finally got it working... The issue I had was that I had a full chain and thus couldn't point to a single file. I had to point to the directory I want the chain in. I couldn't just put the certs in the directory I specified (which is where I failed). Instead I still had to use idpCertChain_1. Putting it another way... If idpCertPath is set to /opt/splunk/etc/apps/myapp/certs , my certs actually live in /opt/splunk/etc/apps/myapp/certs/idpCertChain_1 and were named cert_1, cert_2, etc. Thanks for the help. Scott

scottsavarese · ‎01-09-2019

Sorry, but no... idpCertPath is a relative path as per the authentication.conf documentation you posted. So I wasn't able to move the certs to my apps directory. But give it a try yourself. Just because I couldn't get it to work doesn't mean I did it right.

scottsavarese · ‎01-09-2019

That path is actually relative to the idpCerts directory. It just creates a subdirectory under $SPLUNK_HOME/etc/auth/idpCerts .

scottsavarese · ‎01-09-2019

For SAML authentication, we need to provide a certificate chain to validate the SAML response. The certificate chain appears to be hardcoded to $SPLUNK_HOME/etc/auth/idpCerts . There is a configuration option that will let you specify a subdirectory underneath, but there doesn't seem to be a way to configure anything else. This is great for people that configure SAML via the UI. But not so great for people that use deployment server or similar tools to deploy their configuration to $SPLUNK_HOME/etc/apps . Right now, the SAML authentication.conf file can be deployed, but won't work on its own unless someone manually pushes the certifications to the search heads out of band. Is there a way to deploy certificate chains using deploymentserver? Can I customize the name of the subdirectory from idpCertChain_1 ? Thanks.

scottsavarese · ‎04-08-2017

Thanks for the update... Looking forward to the new version

scottsavarese · ‎04-08-2017

I'm using the sendresults command to send emails to users during a saved search. However, when no rows are returned in the search, the command errors saying that it requires a email_to field. So, I created a quick patch which creates an argument for how to handle the no results case and if set will not signal an error. Let me know your thoughts. Thanks. host:Desktop me$ diff -ru sendresults sendresults-new diff -ru sendresults/bin/sendresults.py sendresults-new/bin/sendresults.py --- sendresults/bin/sendresults.py 2014-06-05 20:27:12.000000000 -0400 +++ sendresults-new/bin/sendresults.py 2017-04-08 09:37:30.000000000 -0400 @@ -196,9 +196,12 @@ if maxrcpts < 1 : logger.error("More than emails would be generated than permitted. Increase your maxrcpts or change your search." % ()) results = splunk.Intersplunk.generateErrorResults("Error : Field maxrcpts must be greater than 0. Increase your maxrcpts.") - elif d2.get('email_to') != len(results) : - logger.error("All results must contain a field named email_to with the intended recipient." % ()) - results = splunk.Intersplunk.generateErrorResults("Error : All results must contain a field named email_to with the intended recipient.") + elif d2.get('email_to') != len(results) : + if toBool( getarg(argvals, “error_on_no_rows”, “true”) ): + logger.error("All results must contain a field named email_to with the intended recipient." % ()) + results = splunk.Intersplunk.generateErrorResults("Error : All results must contain a field named email_to with the intended recipient.") + else: + logger.info(“Email not sent: No rows to process”) else : for event in results : d1[event['email_to']].append(event)

Posts	8
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-17-2012

Online Status	Offline
Date Last Visited	‎11-19-2020 10:56 AM

How do I tell Splunk to use system python versus e...

Is it possible to deploy idpCerts?

Error when there are no rows to email on

How do I tell Splunk to use system python versus e...

Re: Is it possible to deploy idpCerts?

Re: Is it possible to deploy idpCerts?

Re: Is it possible to deploy idpCerts?

Re: Is it possible to deploy idpCerts?

Is it possible to deploy idpCerts?

Re: Error when there are no rows to email on

Error when there are no rows to email on

Are you a member of the Splunk Community?