Security

 View Only
last person joined: yesterday 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Back to discussions
Expand all | Collapse all

Error when importing splunk syslog filter xml file into cppm 6.10

This thread has been viewed 18 times

  • 1.  Error when importing splunk syslog filter xml file into cppm 6.10

    MVP EXPERT
    Posted Jun 29, 2022 08:00 AM
      |   view attached
    Hi,
    Just trying to configure 6.10.4 for splunk connectivity. Have downloaded the  syslog filter file ( which was from cppm 6.3) , replaced %splunk_ip% with the ip address of my server,  changed the version number from 6.3 to 6.10 ( if you dont you get an error message saying  there some invalid xml ) and tried to import it.

    You then get an SQL related error ( see attached image)

    Any ideas?
    A


  • 2.  RE: Error when importing splunk syslog filter xml file into cppm 6.10

    MVP EXPERT
    Posted Jul 06, 2022 07:27 PM
    o.k. so  looking at the  XML file, whsatwe have is a component that says

    <start of sql statement> ..... WHERE ((timestamp &gt;= --START-TIME--) AND (timestamp &lt;= --END-TIME-- <rest of sql statement>

    If you  go into the syslog export filters section in the cppm gui you can  try and create  one of the filters by hand and if you paste in the full sql statement ( obtained from the xml file),   then yes it complains  about self modifying sql  , so that'll be the --START-TIME--  and  --END-TIME-- statements

    Someone must have configured cppm 6.10 to  run with splunk .. haven't they ?

    A
    Original Message


  • 3.  RE: Error when importing splunk syslog filter xml file into cppm 6.10

    Posted Jul 07, 2022 09:32 AM
    I had the same problem with 6.9 trying to import the files but other users did not.

    In the XML file remove the ";" at the end of the SQL statement and see if that helps.
    Original Message


  • 4.  RE: Error when importing splunk syslog filter xml file into cppm 6.10

    MVP EXPERT
    Posted Jul 07, 2022 10:53 AM
    Hells teeth!

    .. and it worked. Many thanks , much appreciated
    A


    Original Message