All Apps and Add-ons

What is the easiest way to DEBUG the Check Point OPSEC LEA app?

jbsplunk
Splunk Employee
Splunk Employee

My OPSEC Application is configured and I get nothing indexed?! How can I figure out what's not working?

1 Solution

Chubbybunny
Splunk Employee
Splunk Employee

The easiest way to debug the App is to run the lea-loggrabber-debug.sh script that comes bundled with it

/opt/splunk/bin/splunk cmd /opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber-debug.sh 

Be prepared to enter the Admin credentials after running the command to authenticate with REST.

Also note, the debug output this script provides to stdout is very very verbose, so feel free to open a Support case for expert advice. Be sure to attach the output for your AWESOME Splunk Support engineer.

View solution in original post

Chubbybunny
Splunk Employee
Splunk Employee

The easiest way to debug the App is to run the lea-loggrabber-debug.sh script that comes bundled with it

/opt/splunk/bin/splunk cmd /opt/splunk/etc/apps/Splunk_TA_opseclea_linux22/bin/lea-loggrabber-debug.sh 

Be prepared to enter the Admin credentials after running the command to authenticate with REST.

Also note, the debug output this script provides to stdout is very very verbose, so feel free to open a Support case for expert advice. Be sure to attach the output for your AWESOME Splunk Support engineer.

ChrisG
Splunk Employee
Splunk Employee

This is documented in the troubleshooting topic in the documentation: http://docs.splunk.com/Documentation/OPSEC-LEA/latest/Install/Runlea-loggrabbermanually

jbsplunk
Splunk Employee
Splunk Employee

This is AWESOME!

0 Karma

skuma30
New Member

call not properly authenticated what does this mean when I try to debug the opsec lea.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...