Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for
- About bawood
bawood
Path Finder
Member since:
11-30-2012
09-10-2021
Community Statistics
| Posts | 31 |
| Solutions | 5 |
| Karma Given | 3 |
| Karma Received | 6 |
| Member Since | 11-30-2012 |
Activity Feed
- Posted Re: inputs.conf.spec python.version on Splunk Dev. 09-10-2021 06:24 AM
- Posted Re: inputs.conf.spec python.version on Splunk Dev. 09-07-2021 05:10 PM
- Posted inputs.conf.spec python.version on Splunk Dev. 09-07-2021 09:27 AM
- Karma Re: DUO Log Add-on for Splunk: When creating a new DUO API input, why do I get "Received 403 Access forbidden" error? for responsys_cm. 06-05-2020 12:48 AM
- Karma Where do enhancements requests go and why are they not published/voted on? for gjanders. 06-05-2020 12:48 AM
- Got Karma for Re: DUO Log Add-on for Splunk: Why am I getting error "[HTTP 500] [HTTP 409] App "TA-DUOSecurity2FA" already exists" after installation?. 06-05-2020 12:48 AM
- Got Karma for Re: DUO Log Add-on for Splunk: When creating a new DUO API input, why do I get "Received 403 Access forbidden" error?. 06-05-2020 12:48 AM
- Karma Re: Why is the Splunk App for ServiceNow returning IDs in JSON format? for wegscd. 06-05-2020 12:47 AM
- Got Karma for Re: In Splunk 6.2.3, what happened to the CountryCode field that was part of the output from using the iplocation command in Splunk 6.0.1?. 06-05-2020 12:47 AM
- Got Karma for Re: In Splunk 6.2.3, what happened to the CountryCode field that was part of the output from using the iplocation command in Splunk 6.0.1?. 06-05-2020 12:47 AM
- Got Karma for Re: Configuration issues. 06-05-2020 12:46 AM
- Got Karma for Re: Error in install Splunk version 5_Cannot merge metadata. 06-05-2020 12:46 AM
- Posted Re: DUO Log Add-on for Splunk: This add-on does not seem to be CIM compliant on All Apps and Add-ons. 01-28-2019 02:14 PM
- Posted Re: All Reasons for Authentication Events not imported on All Apps and Add-ons. 10-16-2018 10:56 AM
- Posted Re: DUO Log Add-on for Splunk: What is the syslog format for DUO events? on All Apps and Add-ons. 08-23-2017 07:31 AM
- Posted Re: DUO Log Add-on for Splunk: What is the syslog format for DUO events? on All Apps and Add-ons. 02-07-2017 10:01 AM
- Posted Re: DUO Log Add-on for Splunk: When creating a new DUO API input, why do I get "Received 403 Access forbidden" error? on All Apps and Add-ons. 02-07-2017 09:40 AM
- Posted Re: DUO Log Add-on for Splunk: This add-on does not seem to be CIM compliant on All Apps and Add-ons. 12-06-2016 08:19 AM
- Posted Re: DUO Log Add-on for Splunk: When creating a new DUO API input, why do I get "Received 403 Access forbidden" error? on All Apps and Add-ons. 11-29-2016 07:13 AM
- Posted Re: DUO Log Add-on for Splunk: Why is DUO not showing up as a Data Input option in 6.5.0? on All Apps and Add-ons. 11-09-2016 10:43 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 |
09-10-2021
06:24 AM
Yes, I understand the purpose of the .spec vs .conf files, the input works if you manually add python.version to the inputs.conf. However the main issue is getting the app certified, not making the input work, so I know it can be deployed on the latest Splunk Enterprise and Cloud (previous versions of the app has been certified and published on Splunkbase for several years).
... View more
09-07-2021
05:10 PM
I'm not sure how to get that written to the inputs.conf when someone creates an input if it's not the spec. Also, I assume it would need to be in the spec file and returned in the scheme for the introspection to succeed. Since it's an error level message, it makes me think I can't submit it for Splunk certification without fixing it.
... View more
09-07-2021
09:27 AM
I have a custom developed modular input that was developed with an older version of the Add-on builder app. The custom code itself has always been compatible with python3, however I'm trying to get the app fully updated to be compatible with the most recent and upcoming versions of Splunk Enterprise and Cloud. To do that I'm trying to get past Splunk App certification. When I attempt the App Pre-certification validation process in Add-on Builder 4.0.0, it gives me the following error Error App Precertification Check that all the modular inputs defined in inputs.conf.spec are explicitly set the python.version to python3. Modular input "example" is defined in README/inputs.conf.spec, python.version should be explicitly set to python3 under each stanza. File: README/inputs.conf.spec Line Number: 3 However, I do have "python.version = python3" specified in the apps inputs.conf.spec file. No matter what I've tried, it keeps giving me the same error, but I can't find anymore info on what might be wrong. Any insight or suggestion would be appreciated.
... View more
Labels
- Labels:
-
add-on
-
modular input
-
python
01-28-2019
02:14 PM
The github repo is here, but if you are just looking for CIM compliance, it was added in version 1.2.0 which has been on Splunkbase for a while. Also 1.2.1 was recently added which passed Splunk's automated AppInspect process. It's currently waiting on some manual inspection to be ok'd for Splunk Cloud installation.
... View more
10-16-2018
10:56 AM
You are correct, the add-on doesn't do any filtering of events. It simply pulls the raw logs from DUO in their default json format and indexes them. There is some eventyping done for CIM compliance, but that doesn't change the indexed data.
If you have access, or someone else in your org has access to DUO's admin web interface, do you see those events listed there? If so, I'd be interested in knowing that, I haven't heard of any issues like this. I've had the add-on published for a couple of years and it hasn't changed much, but that doesn't mean something hasn't changed on DUO's side. DUO publishes their own Splunk app as well now, so I've been debating whether I should update mine or not.
... View more
08-23-2017
07:31 AM
I'm not sure how you get the logs from DUO via syslog. I'm only aware of getting the data from them via their API, in which case it's returned in JSON.
... View more
02-07-2017
10:01 AM
The DUO Log Add-on is primarily a modular input, so it likely won't work correctly if you are grabbing the DUO logs with a different method. The data is returned in JSON directly from their API; https://duo.com/docs/adminapi#logs
so the add-on takes advantage of that because most of the field extraction occurs automatically. The add-on also has some field mapping to make it CIM compliant, which probably won't work correctly if the fields are extracted differently.
It sounds like your Splunk admins may be using one of DUO's example scripts for pulling the logs.
... View more
02-07-2017
09:40 AM
DUO has some basic instructions for setting up access to the APIs here;
https://duo.com/docs/adminapi#first-steps
The add-on uses these APIs from DUO, https://duo.com/docs/adminapi#logs and https://duo.com/docs/adminapi#account-info
so your Ikey needs to be an Admin API key and have access to logs and account-info (if you are trying to pull the account summary) APIs.
... View more
12-06-2016
08:19 AM
It will added to the version on Splunkbase soon, but It's available in the github repo if you need it now.
... View more
11-29-2016
07:13 AM
1 Karma
Most likely this is because the ikey (integration key) is for the Auth API endpoint and not the Admin API. DUO doesn't allow an Auth ikey to access the Admin API. https://duo.com/docs/adminapi#first-steps
... View more
11-09-2016
10:43 AM
Apparently that was markdown turning it into the euro symbol, code block displays it correctly now, sorry about that!
... View more
11-09-2016
10:34 AM
I've installed the app under 6.5 and verified the input is visible, I haven't done extensive testing but I don't think the modular input stuff has changed. You can try navigating directly to the add input data setup page with this path appended to you server url
"/en-US/manager/launcher/adddata/selectsource?input_mode=1&modinput=1&input_type=duo"
If that doesn't work, I'm guessing something is wrong with the installation.
... View more
11-04-2016
01:23 PM
The from in the email stanza defaults to splunk@$LOCALHOST but you can set it to anything. To have them send from the same address, just set them all to splunk@yourdomain. You can't set it through the UI in a cluster, it has to be done on the filesystem, but it works for us.
... View more
10-13-2016
08:23 AM
You can create the index on the heavyforwarder so the add-on sees it as an option, as long as the heavyforwarder is set to send everything to your indexers, the data will be forwarded and not indexed locally.
... View more
09-28-2016
02:30 PM
Apologies, I found a typo in the validation code. I've uploaded a new build of 1.1.0, can you try it again?
... View more
09-26-2016
12:50 PM
I've updated the version of the add-on available on Splunkbase 1.1.0, it has some improved error checking. The default version is still set to 1.0, but you should be able to select 1.1.0 to download. Can you update your install to this version and see if you get any more info the logs?
... View more
09-14-2016
12:58 PM
Splunk adds the config to the local directory of whatever app context the input was added from ( e.g. if you are in the main search app when you clicked add input, it will be in search/local/inputs.conf ).
... View more
09-14-2016
07:43 AM
It sounds like DUO is probably returning an error that isn't being caught by this version of the add-on. You should verify that the ikey you are using was created for the DUO Admin api and not for the Auth api. DUO doesn't allow Auth key access to the admin api or vis-a-versa. If it was created for the Admin api, make sure it has access to the appropriate calls.
... View more
09-14-2016
06:49 AM
I'm not recommending doing this, but if you really need to you can change the history setting, then you would need to remove the checkpoint files under $SPLUNK_HOME/var/lib/splunk/modinputs/duo/
WARNING: doing so will double index the previous data.
If you don't want duplicate data you would need to clear or delete the index or change the input to index in a different one.
... View more
08-03-2016
12:33 PM
You should also be able to find it under the "Add Data" dialog;
try appending this path to your Splunk server's url:
"en-US/manager/TA-DUOSecurity2FA/adddata/selectsource?input_mode=1"
... View more
08-03-2016
12:26 PM
It should be it's own type, "DUO Security 2fa logs" in the Local section.
... View more
08-03-2016
08:34 AM
I just tried installing on a clean 6.4.2 Splunk and the data input showed up and I'm not aware of any compatibility issues it would have with 6.4. It shouldn't even require a restart, but you could try that if you haven't already.
... View more
07-22-2016
01:30 PM
Ok, it sounds like duo is probably returning an error that isn't getting handled. Maybe you are using an ikey that was created for Auth and not the Admin api? I'll add better handling of error returned from the api. If you can/want to try a patch;
diff --git a/bin/duo.py b/bin/duo.py
index ae8f105..1550ed5 100644
--- a/bin/duo.py
+++ b/bin/duo.py
@@ -68,6 +68,8 @@ class MyScript(smi.Script):
except RuntimeError as e:
if "429" in e.message:
ew.log( 'ERROR', "Received 429, too many requests. You may need to increase interval")
+ else:
+ raise e
return
... View more
07-22-2016
10:58 AM
I think it depends on the context where you access the inputs config from, it might be in etc\apps\search\local\
I'm not sure the equivalent way to do this on Windows, but on Linux you can find it with this command;
splunk cmd btool inputs list --debug | grep '\['
... View more
07-21-2016
03:30 PM
It looks like the time 1466539096 is about the same of the log messages, including the "no checkpoint time returned" one, so I'm guessing you might not have set a value for the history field (the number of days of data to pull initially), if it's not set or 0 the timestamp it uses would be the current time. You can try resetting the state if you want to index historical data by setting the history value, then removing the checkpoint files. They should be in "C:\Program Files\Splunk\var\lib\splunk\modinputs\duo\" assuming the path is similar to Linux.
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
09-10-2021
07:18 PM
|
