codingwithjimmy/ta-bigfix

Splunk technical add-on (TA) for ingesting BigFix client, relay, and server logs. Includes REST inputs for ingesting assets, relevant fixlets, action summaries, and analysis results.

ta-bigfix's Issues

Splunk-addon for Big-fix cannot pull all the data from the bigfix to Splunk

Addon: HCL BigFix Add-on for Splunk

Splunk Version: 9.1.1

1. The Splunk add-on is not able to collect logs for analysis, infrastructure, and fixlets.

2. The Bigfix add-on cannot collect all user and action data.

Splunk user have master access to Bigfix data

Test issue

Unable to initialize modular input "bigfix users" defined in the app "TA-bigfix-master": Introspecting scheme=bigfix users

Hi ,

Got below given issue after install of Add-on
Unable to initialize modular input "bigfix users" defined in the app "TA-bigfix-master": Introspecting scheme=bigfix users

I have installed on stand-alone Splunk server.
Please help.
Thanks
Aniket

Cloud Vetting Failed

When I submitted a ticket to Cloud Support to install this TA on my Search Head I received the following report back. Can these issues be fixed so this can be installed on the Cloud?

<< Auto-Generated FAILED vetting comment:

[Cloud Vetting][Liverpool] #Custom 3.0.2 - TA-bigfix
Review fails vetting and cannot be installed.

This is a preliminary report. More issues may be found upon further review.
Thank you for your app install request. Your app did not meet security and functionality requirements for Splunk Cloud for the following reasons:

*[The application can be configured for unencrypted communication, which is not permitted in Splunk Cloud. All communication must be encrypted (HTTPS preferred).]
*User is able to configure url with http scheme which is not allowed on cloud. All calls must go with https. There is no validation available in python code File: bin/TA_bigfix_rh_settings.py Line Number: 30
*Change the version attribute in the root node of your Simple XML dashboard default/data/ui/views/assets.xml to <version=1.1>. Earlier dashboard versions introduce security vulnerabilities into your apps and are not permitted in Splunk Cloud File: default/data/ui/views/assets.xml Line Number: null

Once these issues are remedied you can resubmit your app for review.

In addition the following changes are recommended:
null

Alternatives:
null

Missing data in view's

configuration.xml and inputs.xml are both empty other than calling the base.html template. I receive the following error when navigating to them " An error occurred while reading the page template...." The only data written to the web_service.log is similar to "INFO [5a60399ca07ff1ac66c910] view:1053 - bypass module system fast path". I thought this error was being caused by a conflict with another app but i installed this on TA on an indexer and still received the same error.

Infrastructure input fails when there're some hosts in bigfix that have never reported to the server

Infrastructure input fails when there're some hosts in bigfix that have never reported to the server.

Workaround fix - add whose filter to request in bin/bigfix_infrastructure.cc.json:

--- bin/bigfix_infrastructure.cc.json  2019-12-13 11:32:00.000000000 -0500
+++ bin/bigfix_infrastructure.cc.json   2020-01-09 17:01:57.617838388 -0500
@@ -18,5 +18,5 @@
         {
             "request": {
-                "url": "{{__settings__.additional_parameters.bigfix_server_url}}:{{__settings__.additional_parameters.bigfix_server_port}}/api/query?output=json&relevance=%28%22nt_host%3D%22+%26+item+0+of+it%2C+%22last_report_time%3D%22+%26+item+1+of+it+as+string%2C+%22operating_system%3D%22+%26+item+2+of+it%2C+%22actionsite_size%3D%22+%26+item+3+of+it%2C+%22actionsite_version%3D%22+%26+item+4+of+it%2C+%22relay_free_space%3D%22+%26+item+5+of+it%2C+%22filldb_logfile_size%3D%22+%26+item+6+of+it%2C+%22bufferdir_file_count%3D%22+%26+item+7+of+it%2C+%22registration_list_size%3D%22+%26+item+8+of+it%29+of+%28name+of+it%2C+last+report+time+of+it%2C+operating+system+of+it%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3AActionsite+Size%22%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3AActionsite+Version%22%29+%2C+%28if+%28value+of+result+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ABES+Relay+Free+Disk+Space%22%29+%3D+%22N%2FA%22%29+then+%22%22+else+%28value+of+result+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ABES+Relay+Free+Disk+Space%22%29%29%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3AFillDB+Log+File+Size%22%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ANumber+of+Files+in+FillDB+Bufferdir%22%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ARegistration+List+Size%22%29%29+of+bes+computers++",
+                "url": "{{__settings__.additional_parameters.bigfix_server_url}}:{{__settings__.additional_parameters.bigfix_server_port}}/api/query?output=json&relevance=%28%22nt_host%3D%22+%26+item+0+of+it%2C+%22last_report_time%3D%22+%26+item+1+of+it+as+string%2C+%22operating_system%3D%22+%26+item+2+of+it%2C+%22actionsite_size%3D%22+%26+item+3+of+it%2C+%22actionsite_version%3D%22+%26+item+4+of+it%2C+%22relay_free_space%3D%22+%26+item+5+of+it%2C+%22filldb_logfile_size%3D%22+%26+item+6+of+it%2C+%22bufferdir_file_count%3D%22+%26+item+7+of+it%2C+%22registration_list_size%3D%22+%26+item+8+of+it%29+of+%28name+of+it%2C+last+report+time+of+it%2C+operating+system+of+it%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3AActionsite+Size%22%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3AActionsite+Version%22%29+%2C+%28if+%28value+of+result+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ABES+Relay+Free+Disk+Space%22%29+%3D+%22N%2FA%22%29+then+%22%22+else+%28value+of+result+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ABES+Relay+Free+Disk+Space%22%29%29%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3AFillDB+Log+File+Size%22%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ANumber+of+Files+in+FillDB+Bufferdir%22%29+%2C+values+of+results+%28it+%2C+bes+property+%22BES+Health+Checks%3A%3ARegistration+List+Size%22%29%29+of+bes+computers+whose+%28exists+operating+system+of+it%29++",
                 "method": "GET",
                 "headers": {},
@@ -86,3 +86,3 @@
         }
     ]
-}
\ No newline at end of file
+}