Thanks For Downloading!
Review the documentation below and follow any custom installation steps. If no install steps are listed, most Splunk Apps and Add-ons can be installed as follows:
Unix/Linux: Decompress the downloaded file using a tool like
RSA SecurID Appliance application for Splunk
This application was designed to give users usable data surrounding the activity taking place on their RSA SecurID appliances. This application will work with both the RSA SecurID Appliance 130 and 230 models.
Scripted Inputs: For the "Network Activity" view to properly work there is a scripted input that needs to be configured. This scripted input uses the snmpget command to retrieve specific values from the device. If you have multiple devices then you need to configure multiple scripted inputs. Follow these steps:
1. Copy the sample inputs.conf file from $SPLUNK_HOME/etc/apps/RSASecurID/default/inputs.conf to your local folder, just so no changes are overwritten if the application is updated.
2. Edit the inputs.conf file and change the script stanza to reflect your device configuration:
[script://$SPLUNK_HOME/etc/apps/RSASecurID/bin/getSnmpData.sh public 18.104.22.168]
Change "public" to be the community name configured on your appliance that has read access. Change "22.214.171.124" to be the IP Address of your appliance. Change "disabled = 1" to "disabled = 0" to enable the scripted input.
3. If you have multiple appliances, just copy/paste the [script://] stanza for as many appliances as you have and configure the appropriate values as mentioned above.
Monitored Inputs: There is an example [monitor://] stanza in the inputs.conf file. Configure this for the proper location of the file that your SNMP traps are being logged to. If the SNMP traps are already being indexed by Splunk then this can be ignored.
Reports in this Application:
User Activity View:
Network Activity View:
Versions and Release Notes
Version 1.1 (current version - updated Jul 05, 2012)
- Most significant update is to support snmptraps that are being directly captured by Splunk
Please forgive my ignorance, in the pre-deployment assumptions, what do I need to do to get snmpget into my $PATH? I'm running Splunk on Windows, not sure if that matters.
reviewed 14 Jun '12, 09:09
accept rate: 20%
I would be interested in seeing the updated app (and hope you get it Splunk supported).
My question is would be it be possible to use a Universal forwarder on our RSA servers (they are VM's, not actual appliances) instead of setting up SNMP traps to get that information into our central Splunk Indexer?
Thank you in advance.
reviewed 23 Mar '12, 12:24
accept rate: 0%
Just checking to see if this app is still supported or current? When I search for it under the Splunk find more Apps section, it no longer shows up.
reviewed 19 Mar '12, 13:34
accept rate: 0%