All Apps and Add-ons

Risk Manager: Search runs, but risk score not applied to objects.

dteo827
Explorer

Hey Risk Manager Admins,

Great app you have, but I've had some problems recently of assigning risk to risk objects.
First a few qualifiers.

Running Splunk 6.3
TA-risk manager is installed.
The default risks index is being used.
The risk_handler.py file is symlinked and has Splunk accessible permissions.
Alerting is set to "always".
The search is pointed at risk_handler.py, and is running correctly.
Risk object, Risk score, and collect contributing data is configured.
I've gone through this as best as possible with no luck: http://wiki.splunk.com/Community:TroubleshootingAlertScripts

I've followed your install and config guide perfectly and double checked everything.
The risk overview dashboard is full of 0's, NA, and no results found.
Is there anything I'm missing?

Regards,

0 Karma
1 Solution

dteo827
Explorer

Three and a half months later....
When My team migrated from a single Linux environment to a distributed windows Splunk environment, Risk Manager broke.
If you have the same problem, and If searches are configured and risk scores are being added in the settings, but the risks index is not populating, it is probably because of lines 23-24 in risk_handler.py.

The fix for me was just commenting them out (as they're linux comands) and everything worked properly.

23 | #sys.stdout = open('/tmp/stdout2', 'a')
24 | #sys.stderr = open('/tmp/stderr2', 'a')

If I can help in any other way, drop me a line.

Cheers!

View solution in original post

0 Karma

dteo827
Explorer

Three and a half months later....
When My team migrated from a single Linux environment to a distributed windows Splunk environment, Risk Manager broke.
If you have the same problem, and If searches are configured and risk scores are being added in the settings, but the risks index is not populating, it is probably because of lines 23-24 in risk_handler.py.

The fix for me was just commenting them out (as they're linux comands) and everything worked properly.

23 | #sys.stdout = open('/tmp/stdout2', 'a')
24 | #sys.stderr = open('/tmp/stderr2', 'a')

If I can help in any other way, drop me a line.

Cheers!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...