Splunk v1.0.9 FAQ

Updated 1 week ago by Elvis Hovor

This document explains how to install Splunk in an air-gapped environment or from the CLI, how to update or uninstall it, and covers basic troubleshooting steps.

Installing the Splunk Integration in an Air-Gapped Environment

A.  When the instance where you want to install the TruSTAR Splunk integration is not connected to the internet, you will need to download the TruSTAR files and then manually move them to the instance. 

Download the files:

OR

Installing the Splunk Integration from the CLI (Command Line Interface)

TruSTAR recommends installing from the user interface but you can choose to install from the command line by following these instructions:

  1. Download the files:

OR

  1. Execute the following commands:
  • cd $SPLUNK_HOME
  • ./splunk install app TA-trustar.spl
  • ./splunk install app Trustar.spl 

Uninstalling the Integration

To manually delete the integration:

  • Go to $SPLUNK_HOME/etc/apps/ and remove TA-trustar and Trustar 
  • Restart Splunk

Updating the Splunk Integration

You can update the integration from the user interface, the command line, or manually.

To update through the user interface:

  1. Click Manage Apps.
  2. Find the Trustar App And TA entry from list.
  3. Click the link of the newer version under Version Column on related entry.
  4. Install the TA first, followed by the App.

To update from the command line:

  1. Download the tar of App or TA from Splunkbase.
  2. Stop the Splunk server.
  3. Execute this command: $SPLUNK_HOME/bin/splunk 
  4. Install app using this command: APP_NAME.tgz –update 1 –auth username:password
  5. Restart the Splunk Server.

To update manually:

  1. Click Manage Apps.
  2. Click Install App from File.
  3. Locate the Trustar TA file on your local drive.
  4. Select Upgrade App.
  5. Click Upload.
  6. Repeat the above steps for the TruSTAR app.

Troubleshooting

Q: My Dashboard is not being populated?

A: On initial setup of the TruSTAR app it takes about 24 hours depending on the amount of data being ingested into TruSTAR for all data to be downloaded into the splunk and the dashboard to be fully populated. To confirm if data is being ingested selected the imported data tab and check if new reports are being downloaded. Reach out to TruSTAR support if the dashboard isn't fully populated after 48 hours.

Q: Can Splunk index my TruSTAR App and TA Logs to an index of my choice?

A:T Yes, and this is a convenient way to use the Splunk user interfaceto look at the logs generated by your TruSTAR integration components.

  • Create a file/directory monitor input and have it monitor this directory: $SPLUNK_HOME/var/log/trustar/ (replace $SPLUNK_HOME with your splunk directory.) That directory will have 2 log files: "trustar_match.log" and "trustar_modinput.log".
    • "trustar_modinput.log": this is the log file for the TA.
    • "trustar_match.log": this is the log file for the app.

Q: Where can I find my checkpoint file?

A: A checkpoint file for each rest input can be found in this directory: $SPLUNK_HOME/var/lib/splunk/modinputs/trustar/ and the filename for a given rest input's checkpoint will be the name of the rest input.Known Issues

How do I find out if TruSTAR app search is consuming a lot of Splunk memory?

This Splunk knowledge base document has information on how to identify your top memory consuming searches: http://docs.splunk.com/Documentation/Splunk/7.0.0/Troubleshooting/Troubleshootmemoryusage

I get an authentication error when configuring the TruSTAR App.

  • Check to make sure all your credentials are entered correctly. 
  • Verify that you have write and read access for the enclave you have selected. 
  • Check to see if your firewall is blocking traffic from TruSTAR.

6. How much storage does TruSTAR use in Splunk?

The TruSTAR app will consume some storage; this is standard for threat intelligence applications that let you match intel against your local Splunk instance. The TruSTAR platform focuses on high value IOCs that have been submitted by other analysts, which means you do not receive large volumes of data.

Each TruSTAR report is approximately 10KB (could be smaller or larger based on the amount of context in the report but should not be significantly different).
A daily download of IOC's should be around 250-500KB (depending on how much data is available in your enclave and the community).

Known Issues

The Export PDF function on the TruSTAR app doesn’t work. How can I export a report?

The Splunk application does not allow the full download of a PDF in the format used by the TruSTAR App. As a workaround, you can use your browser to save the report; this will guarantee that the full report is downloaded with an appearance close to the original.


How Did We Do?