Getting Data In

Splunk for Microsoft Exchange Application

michaeloleary
Path Finder

Hey Folks,

I'm trying to get the reputation check script running on a mail server at the moment and I'm running into some difficulty. Unfortunately the Dashboard is displaying N/A for the reputation check, I have tried troubleshooting the issue by running the command locally.

*C:\Program Files\SplunkUniversalForwarder\bin>splunk cmd "C:\Program Files\Splun
kUniversalForwarder\etc\apps\fwd_reputation\bin\check_my_reputation.py"
CreateProcess: error 193
couldn't run "C:\Program Files\SplunkUniversalForwarder\etc\apps\fwd_reputation\
bin\check_my_reputation.py": The parameter is incorrect.*

The only configuration change for this script that I can see is that I need to set the IP address of my mail server in reputation.conf file as per the document located at the following:

http://docs.splunk.com/Documentation/MSExchange/latest/DeployMSX/Makeconfigurationchangestomatchyour...

I'm trying to figure out what parameter the script is referring that is causing the script to fail, would anyone know what could be causing this?

Any help you guys can provide would be greatly appreciated.

Regards
Mike

Tags (4)
0 Karma
2 Solutions

ahall_splunk
Splunk Employee
Splunk Employee

This is, unfortunately, a known bug that will be fixed in the next version. Go into the $SPLUNK_HOME/etc/apps/TA-SMTP-Reputation/default directory and edit the inputs.conf file - change all referenced for fwd_reputation to TA-SMTP-Reputation (global search and replace). Save the file, then restart your splunk instance.

View solution in original post

ahall_splunk
Splunk Employee
Splunk Employee

Also, note that - per the documentation - you need to run TA-SMTP-Reputation on a Heavy Forwarder - the Universal Forwarder cannot run Python based scripted inputs such as this one. (sorry - just noticed that from your command line).

View solution in original post

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

Also, note that - per the documentation - you need to run TA-SMTP-Reputation on a Heavy Forwarder - the Universal Forwarder cannot run Python based scripted inputs such as this one. (sorry - just noticed that from your command line).

0 Karma

malmoore
Splunk Employee
Splunk Employee

Docs updated.

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

Noted - I'll get the docs clarified.

0 Karma

michaeloleary
Path Finder

Thanks for the help Adrian, I was able to make the appropriate changes to rectify the issue based on the info you gave 🙂

On another note I can't find the information about the heavy forwarder, I can only assume I'm using an old version of the documentation.

0 Karma

ahall_splunk
Splunk Employee
Splunk Employee

This is, unfortunately, a known bug that will be fixed in the next version. Go into the $SPLUNK_HOME/etc/apps/TA-SMTP-Reputation/default directory and edit the inputs.conf file - change all referenced for fwd_reputation to TA-SMTP-Reputation (global search and replace). Save the file, then restart your splunk instance.

ahall_splunk
Splunk Employee
Splunk Employee

Yes it does. The genesis is that the TA used to be called fwd_reputation, but we renamed it to follow the standard TA naming scheme, and forgot to update the references. It's already been fixed in the SCM, but I'm doing a bunch of other fixes before I do the next release.

0 Karma

michaeloleary
Path Finder

I'm just looking at the python script I see the following line of code too.

app_path = os.path.join(os.environ["SPLUNK_HOME"], 'etc', 'apps', 'fwd_reputation')

I'm no python programmer but I'm assuming that needs to change as well.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...