Risk Manager: Search runs, but risk score not applied to objects.

[dteo827]

Hey Risk Manager Admins,

Great app you have, but I've had some problems recently of assigning risk to risk objects.
First a few qualifiers.

Running Splunk 6.3
TA-risk manager is installed.
The default risks index is being used.
The risk_handler.py file is symlinked and has Splunk accessible permissions.
Alerting is set to "always".
The search is pointed at risk_handler.py, and is running correctly.
Risk object, Risk score, and collect contributing data is configured.
I've gone through this as best as possible with no luck: http://wiki.splunk.com/Community:TroubleshootingAlertScripts

I've followed your install and config guide perfectly and double checked everything.
The risk overview dashboard is full of 0's, NA, and no results found.
Is there anything I'm missing?

Regards,

[dteo827 · Accepted solution]

Three and a half months later....
When My team migrated from a single Linux environment to a distributed windows Splunk environment, Risk Manager broke.
If you have the same problem, and If searches are configured and risk scores are being added in the settings, but the risks index is not populating, it is probably because of lines 23-24 in risk_handler.py.

The fix for me was just commenting them out (as they're linux comands) and everything worked properly.

23 | #sys.stdout = open('/tmp/stdout2', 'a')
24 | #sys.stderr = open('/tmp/stderr2', 'a')

If I can help in any other way, drop me a line.

Cheers!