I downloaded an app that does exactly what I need to collect BSM audit logs, however it is for version 3.x. I thought I would give it a try and install it anyway, in hopes that it would still work, but it doesnt. The url for the app I have been looking at is here:
After I install it add an apps.conf and run the directions in the readme, I get this error:
$ python bin/bsmping.py --noCache=True
Traceback (most recent call last):
File "bin/bsmping.py", line 9, in <module>
import splunk.clilib.cli_common as comm
ImportError: No module named splunk.clilib.cli_common
I am not familiar enough with python or the changes in splunk from 3.x to 4.x to even know where to start fixing this problem.
Any input is appreciated, thanks!
Apparently some referenced libraries are not in the pythonpath environment variable and so python cannot find them.
Try running this script like this: ./splunk cmd python bin/bsmping.py --noCache=True
It will start Python with all environmental variables properly set.
I'm not familiar with the app, but you might need to create a 'bsm' directory under /var/spool/splunk inside your Splunk installation directory. The script requires this path to exist.
Apparently some referenced libraries are not in the pythonpath environment variable and so python cannot find them.
Try running this script like this: ./splunk cmd python bin/bsmping.py --noCache=True
It will start Python with all environmental variables properly set.
I'm not familiar with the app, but you might need to create a 'bsm' directory under /var/spool/splunk inside your Splunk installation directory. The script requires this path to exist.
used for testing the script included with the salesforce TA app
This definitely helps, running it with the environment variables worked.