All Apps and Add-ons

Cisco Security Suite app and add ons install

Starlette
Contributor

When installing the new cisco security app and addons you get the error during tar

implausibly old time stamp 1970-01-01 01:00:00

fi

Splunk_CiscoIPS/default/data/ui/views/ips_overview.xml tar: Splunk_CiscoIPS/default/data/ui/views/ips_overview.xml: implausibly old time stamp 1970-01-01 01:00:00 Splunk_CiscoIPS/default/data/ui/views/rt_ips.xml tar: Splunk_CiscoIPS/default/data/ui/views/rt_ips.xml: implausibly old time stamp 1970-01-01 01:00:00 Splunk_CiscoIPS/default/eventtypes.conf tar: Splunk_CiscoIPS/default/eventtypes.conf: implausibly old time stamp 1970-01-01 01:00:00 Splunk_CiscoIPS/default/inputs.conf tar: Splunk_CiscoIPS/default/inputs.conf: implausibly old time stamp 1970-01-01 01:00:00 Splunk_CiscoIPS/default/macros.conf tar: Splunk_CiscoIPS/default/macros.conf: implausibly old time stamp 1970-01-01 01:00:00 Splunk_CiscoIPS/default/props.conf tar: Splunk_CiscoIPS/default/props.conf: implausibly old time stamp 1970-01-01 01:00:00 Splunk_CiscoIPS/default/restmap.conf tar: Splunk_CiscoIPS/default/restmap.conf: implausibly old time stamp 1970-01-01 01:00:00 Splunk_CiscoIPS/default/savedsearches.conf tar: Splunk_CiscoIPS/default/savedsearches.conf: implausibly old time stamp 1970-01-01 01:00:00 Splunk_CiscoIPS/default/setup.xml

after that the conf file are R only, so you cant change anything ( by default with gui) can I ignore the messages? ( and change the file rights with RW, or am I running in troubles and do I have to wait for a splunk fix?

0 Karma

LukeMurphey
Champion

Implausibly Old Timestamps

The root cause for the implausibly old time stamp issue has been identified and will be addressed in a maintenance release of the app (reference issue SOLN-949).

Read-Only Conf Files

You should not edit the configuration files under the default directory. Instead, you can override the default conf file settings by creating a conf file with the same name under the local directory with the parameters you want to change.

For example, the Cisco Security Suite app ships with an app.conf file under default (etc/apps/Splunk_CiscoSecuritySuite/default/app.conf) that includes the following:

[install]
state = enabled
is_configured = false
build = 96705

Once you configure the app in the Splunk UI, Splunk overrides the "is_configured" field by making a local conf file (etc/apps/Splunk_CiscoSecuritySuite/local/app.conf) that overrides the is_configured field:

[install]
is_configured = true

The local version takes precedence over the default conf file; thus, Splunk acts the same as if the default app.conf file had been modified and is_configured will be considered to have a value of "true".

It is important to edit the local conf files because the settings you put under the local directory will persist after an upgrade. However, settings made in the default directory are not upgrade safe.

Source: Splunk Docs

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...