Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Form input fields not showing in Wazuh Splunk app on CentOS 8 Stream #1307

Open
rauldpm opened this issue Apr 20, 2022 · 2 comments
Open

Form input fields not showing in Wazuh Splunk app on CentOS 8 Stream #1307

rauldpm opened this issue Apr 20, 2022 · 2 comments
Labels
type/bug Bug issue

Comments

@rauldpm
Copy link
Member

rauldpm commented Apr 20, 2022 •
edited
Loading

Wazuh Splunk Rev
4.3 8.2.2 4303

Description

Performing a single-instance deployment according to this documentation, if the Wazuh app is installed together with Splunk enterprise on CentOS 8 Stream, the form input fields where the credentials, port, and alias must be entered is not displayed

This behavior is not reproduced if the Wazuh app and Splunk enterprise are installed on CentOS 7

Wazuh app does not show form input fields:

Node1 (Vagrant CentOS 7)           - Wazuh manager + Splunk forwarder
Node2 (Vagrant CentOS 8 Stream)    - Wazuh app + Splunk enterprise

Wazuh app show form input fields:

Node1 (Vagrant CentOS 8 Stream)    - Wazuh manager + Splunk forwarder
Node2 (Vagrant CentOS 7)           - Wazuh app + Splunk enterprise

Steps to reproduce

  1. Install Wazuh manager in CentOS 7 (node1)
  2. Install Splunk enterprise in CentOS 8 Stream (node2)
  3. Install Splunk forwarder in CentOS 7 (node1)
  4. Install the Wazuh app in CentOS 8 Stream (node2)
Node1 CentOS 7 commands (192.168.57.102) 

(install Wazuh manager in node 1)

#  rpm --import https://packages.wazuh.com/key/GPG-KEY-WAZUH
#  cat > /etc/yum.repos.d/wazuh.repo << EOF
[wazuh]
gpgcheck=1
gpgkey=https://packages-dev.wazuh.com/key/GPG-KEY-WAZUH
enabled=1
name=EL-\$releasever - Wazuh
baseurl=https://packages-dev.wazuh.com/pre-release/yum/
protect=1
EOF

#  yum install -y wazuh-manager
#  systemctl start wazuh-manager

(install Splunk enterprise in node 2)
(install Splunk forwarder in node 1)

#  yum localinstall splunkforwarder-8.2.2.rpm -y
#  curl -so /opt/splunkforwarder/etc/system/local/props.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.0-8.2.2/setup/forwarder/props.conf
#  curl -so /opt/splunkforwarder/etc/system/local/inputs.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.0-8.2.2/setup/forwarder/inputs.conf
#  sed -i "s:MANAGER_HOSTNAME:$(hostname):g" /opt/splunkforwarder/etc/system/local/inputs.conf
#  /opt/splunkforwarder/bin/splunk start
#  /opt/splunkforwarder/bin/splunk add forward-server 192.168.57.104:1024
#  /opt/splunkforwarder/bin/splunk restart

(install Wazuh app in node 2)
Node2 CentOS 8 Stream commands (192.168.57.104) 
#  yum localinstall splunk-8.2.2.rpm 
#  curl -so /opt/splunk/etc/system/local/indexes.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.0-8.2.2/setup/indexer/indexes.conf
#  curl -so /opt/splunk/etc/system/local/inputs.conf https://raw.githubusercontent.com/wazuh/wazuh-splunk/v4.3.0-8.2.2/setup/indexer/inputs.conf
#  /opt/splunk/bin/splunk start

(add port in Splunk UI -> e.g. 1024)

#  /opt/splunk/bin/splunk restart

(install Splunk forwarder in node 1)
(install the Wazuh app in node 2)

#  curl -o SplunkAppForWazuh.tar.gz https://packages-dev.wazuh.com/pre-release/ui/splunk/wazuh_splunk-4.3.0_8.2.2-1.tar.gz
#  /opt/splunk/bin/splunk install app SplunkAppForWazuh.tar.gz
#  /opt/splunk/bin/splunk restart
 
(access UI and try to add API credentials)

Regarding the alerts displayed on the health status of Splunk, the following is seen:

image
image

Ingestion Latency 
Ingestion Latency

    Root Cause(s):
        Events from tracker.log have not been seen for the last 1440 seconds, which is more than the red threshold (210 seconds). This typically occurs when indexing or forwarding are falling behind or are blocked.

    [Generate Diag](http://192.168.57.104:8000/en-US/app/splunk_rapid_diag/task_template_wizard?feature=undefined)?If filing a support case, click here to generate a diag.
    Last 50 related messages:
        04-20-2022 12:47:13.976 +0000 INFO TailingProcessor [5124 MainTailingThread] - Adding watch on path: /opt/splunk/var/spool/splunk.
        04-20-2022 12:47:13.976 +0000 INFO TailingProcessor [5124 MainTailingThread] - Adding watch on path: /opt/splunk/var/run/splunk/search_telemetry.
        04-20-2022 12:47:13.976 +0000 INFO TailingProcessor [5124 MainTailingThread] - Adding watch on path: /opt/splunk/var/log/watchdog.
        04-20-2022 12:47:13.976 +0000 INFO TailingProcessor [5124 MainTailingThread] - Adding watch on path: /opt/splunk/var/log/splunk.
        04-20-2022 12:47:13.976 +0000 INFO TailingProcessor [5124 MainTailingThread] - Adding watch on path: /opt/splunk/var/log/introspection.
        04-20-2022 12:47:13.976 +0000 INFO TailingProcessor [5124 MainTailingThread] - Adding watch on path: /opt/splunk/etc/splunk.version.
        04-20-2022 12:47:13.976 +0000 INFO TailingProcessor [5124 MainTailingThread] - Parsing configuration stanza: monitor://$SPLUNK_HOME/var/log/watchdog/watchdog.log*.
        04-20-2022 12:47:13.975 +0000 INFO TailingProcessor [5124 MainTailingThread] - Parsing configuration stanza: monitor://$SPLUNK_HOME/var/log/splunk/splunk_instrumentation_cloud.log*.
        04-20-2022 12:47:13.975 +0000 INFO TailingProcessor [5124 MainTailingThread] - Parsing configuration stanza: monitor://$SPLUNK_HOME/var/log/splunk/license_usage_summary.log.
        04-20-2022 12:47:13.975 +0000 INFO TailingProcessor [5124 MainTailingThread] - Parsing configuration stanza: monitor://$SPLUNK_HOME/var/log/splunk.
        04-20-2022 12:47:13.975 +0000 INFO TailingProcessor [5124 MainTailingThread] - Parsing configuration stanza: monitor://$SPLUNK_HOME/var/log/introspection.
        04-20-2022 12:47:13.975 +0000 INFO TailingProcessor [5124 MainTailingThread] - Parsing configuration stanza: monitor://$SPLUNK_HOME/etc/splunk.version.
        04-20-2022 12:47:13.975 +0000 INFO TailingProcessor [5124 MainTailingThread] - Parsing configuration stanza: batch://$SPLUNK_HOME/var/spool/splunk/tracker.log*.
        04-20-2022 12:47:13.975 +0000 INFO TailingProcessor [5124 MainTailingThread] - Parsing configuration stanza: batch://$SPLUNK_HOME/var/spool/splunk/...stash_new.
        04-20-2022 12:47:13.974 +0000 INFO TailingProcessor [5124 MainTailingThread] - Parsing configuration stanza: batch://$SPLUNK_HOME/var/spool/splunk/...stash_hec.
        04-20-2022 12:47:13.974 +0000 INFO TailingProcessor [5124 MainTailingThread] - Parsing configuration stanza: batch://$SPLUNK_HOME/var/spool/splunk.
        04-20-2022 12:47:13.974 +0000 INFO TailingProcessor [5124 MainTailingThread] - Parsing configuration stanza: batch://$SPLUNK_HOME/var/run/splunk/search_telemetry/*search_telemetry.json.
        04-20-2022 12:47:13.974 +0000 INFO TailingProcessor [5124 MainTailingThread] - TailWatcher initializing...
Disk space 
Disk Space

    Root Cause(s):
        The diskspace remaining=293 has breached the red threshold for filesystems=[/opt/splunk/var/lib/splunk/audit/db]

    [Generate Diag](http://192.168.57.104:8000/en-US/app/splunk_rapid_diag/task_template_wizard?feature=disk_space)?If filing a support case, click here to generate a diag.
    Last 50 related messages:
        04-20-2022 13:11:20.019 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:19.003 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:17.996 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:16.995 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:15.982 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:14.980 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:13.964 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:12.958 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:11.957 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:10.956 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:09.955 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:08.954 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:07.953 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:06.952 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:05.940 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:04.938 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:03.933 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:02.929 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:01.928 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:11:00.923 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:59.903 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:58.899 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:57.897 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:56.891 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:55.889 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:54.887 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:53.886 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:52.885 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:51.883 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:50.883 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:49.883 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:48.882 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:47.881 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:46.877 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:45.875 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:44.875 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:43.874 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:42.874 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:41.873 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:40.870 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:39.868 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:38.868 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:37.867 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:36.867 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:35.866 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:34.866 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:33.865 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:32.865 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:31.864 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db
        04-20-2022 13:10:30.863 +0000 WARN DiskMon [5076 indexerPipe] - MinFreeSpace=5000. The diskspace remaining=293 is less than 1 x minFreeSpace on /opt/splunk/var/lib/splunk/audit/db

Screenshots
image

Wazuh app tab in CentOS 8 Stream:

image

Wazuh app tab in CentOS 7

image

Regards Raúl.
@rauldpm rauldpm added type/bug Bug issue cicd labels Apr 20, 2022
@rauldpm rauldpm changed the title Dialogs boxes not showing in wazuh splunk app on centos8 stream Form input fields not showing in wazuh splunk app on centos8 stream Apr 20, 2022
@rauldpm
Copy link
Member Author

rauldpm commented Apr 20, 2022

Investigating the browser's developer console, I can see the following:

  • Mozilla Firefox
Some cookies are misusing the recommended “SameSite“ attribute 438
Source map error: Error: request failed with status 404
Resource URL: http://192.168.57.104:8000/static/app/SplunkAppForWazuh/js/libs/router.js
Source Map URL: angular-ui-router.min.js.map

Source map error: Error: request failed with status 404
Resource URL: http://192.168.57.104:8000/static/app/SplunkAppForWazuh/js/libs/aria.js
Source Map URL: angular-aria.min.js.map

Source map error: Error: request failed with status 404
Resource URL: http://192.168.57.104:8000/static/app/SplunkAppForWazuh/js/libs/angular.js
Source Map URL: angular.min.js.map

Source map error: Error: request failed with status 404
Resource URL: http://192.168.57.104:8000/static/app/SplunkAppForWazuh/js/libs/codemirror-conv/querystring-browser/bundle.js
Source Map URL: bundle.js.map

Source map error: Error: request failed with status 404
Resource URL: http://192.168.57.104:8000/static/app/SplunkAppForWazuh/js/libs/animate.js
Source Map URL: angular-animate.min.js.map
  • Brave (show two errors too)
DevTools failed to load source map: Could not load content for http://192.168.57.104:8000/static/app/SplunkAppForWazuh/js/libs/angular.min.js.map: HTTP error: status code 404, net::ERR_HTTP_RESPONSE_CODE_FAILURE

DevTools failed to load source map: Could not load content for http://192.168.57.104:8000/static/app/SplunkAppForWazuh/js/libs/angular-aria.min.js.map: HTTP error: status code 404, net::ERR_HTTP_RESPONSE_CODE_FAILURE

DevTools failed to load source map: Could not load content for http://192.168.57.104:8000/static/app/SplunkAppForWazuh/js/libs/angular-animate.min.js.map: HTTP error: status code 404, net::ERR_HTTP_RESPONSE_CODE_FAILURE

DevTools failed to load source map: Could not load content for http://192.168.57.104:8000/static/app/SplunkAppForWazuh/js/libs/angular-ui-router.min.js.map: HTTP error: status code 404, net::ERR_HTTP_RESPONSE_CODE_FAILURE

DevTools failed to load source map: Could not load content for http://192.168.57.104:8000/static/app/SplunkAppForWazuh/js/libs/codemirror-conv/querystring-browser/bundle.js.map: HTTP error: status code 404, net::ERR_HTTP_RESPONSE_CODE_FAILURE

index.js:1121          POST http://192.168.57.104:8000/en-US/splunkd/__raw/servicesNS/wazuh/SplunkAppForWazuh/search/jobs 503 (Service Unavailable)

index.js:1121          POST http://192.168.57.104:8000/en-US/splunkd/__raw/servicesNS/wazuh/SplunkAppForWazuh/search/jobs 503 (Service Unavailable)

@xrisbarney
Copy link

xrisbarney commented Apr 28, 2022 •
edited
Loading

@rauldpm

I just had this same issue of not seeing the input fields in a cluster deployment running on Centos 7 boxes.

The error message from splunkd.log was:

2022-04-28T11:47:18.166Z I ACCESS [main] permissions on /opt/splunk/var/lib/splunk/kvstore/mongo/splunk.key are too open

After updating the permissions of /opt/splunk/var/lib/splunk/kvstore/mongo/splunk.key from 755 to 400, the dialog fields showed.
chmod -R 400 /opt/splunk/var/lib/splunk/kvstore/mongo/splunk.key

I did not note the permissions before installing the App so I cannot say if the permissions for /opt/splunk/var/lib/splunk/kvstore/mongo/splunk.key changed when the Wazuh app for Splunk was installed.

It has been included in the documentation.

Let me know if this works for you.

@rauldpm rauldpm changed the title Form input fields not showing in wazuh splunk app on centos8 stream Form input fields not showing in Wazuh Splunk app on CentOS 8 Stream Oct 3, 2022
@gdiazlo gdiazlo removed the cicd label Mar 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
type/bug Bug issue
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@gdiazlo @rauldpm @xrisbarney