Universal Forwarder

[lukasmrtvy]

Is possible to modify UF to be able to run TA-connectivity addon?

Running:

apt update && apt install -y python
ln -s /usr/bin/python /opt/splunk/bin/python
ln -s /usr/lib/python2.7 /opt/splunk/bin/python2.7

Still there are some issues with splunk pyhon dependencies...

python: can't open file '/opt/splunk/lib/python2.7/site-packages/splunk/clilib/cli.py': [Errno 2] No such file or directory

Difference between Heavy Splunk and UFW is like 500mb in size...

[seunomosowon]

Hi Lukas, I'll see what I can do later. There's definitely a way to use python externally. Cheers

…

On Mon, 31 Jul 2017 at 08:42, Lukas M ***@***.***> wrote: Is possible to modify UF to be able to run TA-connectivity addon? Running: apt update && apt install -y python ln -s /usr/bin/python /opt/splunk/bin/python ln -s /usr/lib/python2.7 /opt/splunk/bin/python2.7 Still there are some issues with splunk pyhon dependencies... python: can't open file '/opt/splunk/lib/python2.7/site-packages/splunk/clilib/cli.py': [Errno 2] No such file or directory — You are receiving this because you are subscribed to this thread. Reply to this email directly, view it on GitHub <#2>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA_Zs9eHManQ3EogMFEjlH6Y_zV7wWZ_ks5sTYV3gaJpZM4OoApL> .

[lukasmrtvy]

Hello,
( site-packages/splunk* is not splunk-sdk. )
It cannot be downloaded, its embedded in splunk enterprise.
So only Splunk or Splunk Heavy Forwarder can run this addon.

[seunomosowon]

Yes. It needs to be run on a full Splunk enterprise instance or HF as it is, but I could add a script to this that can be called externally. See this the read me here https://splunkbase.splunk.com/app/1473/#/details

…

On Mon, 31 Jul 2017 at 11:05, Lukas M ***@***.***> wrote: Hello, ( site-packages/splunk* is not splunk-sdk. ) It cannot be downloaded, its embedded in splunk enterprise. So only Splunk or Splunk Heavy Forwarder can run this addon. — You are receiving this because you commented. Reply to this email directly, view it on GitHub <#2 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AA_ZsyYApBuD03RqQU28a2KB6ULgb6vHks5sTab3gaJpZM4OoApL> .