Troubleshoot the TISC add-on in Splunk
Enable debug logging on the add-on, view the resulting log entries in Splunk, and check input execution status from the Input Metadata Lookup KV store.
Before you begin
Role required: Splunk admin
The TISC add-on is installed and configured. See Configure TISC add-on in Splunk.
About this task
Use this procedure when an input is not pulling observables from TISC as expected, when records appear stale or missing in the KV store, or to inspect the execution history of a configured input.
Procedure
From the add-on, open the Configuration page and select the Logging tab.
Set Log level to DEBUG and select Save.
Subsequent input runs provide verbose debug statements that can be searched in Splunk.
To view the debug entries, run a search in Splunk that scopes to the add-on's internal logs and filters on the
DEBUGlevel.For example:
index=_internal sourcetype=splunkd "TA-threat-intelligence-security-center" log_level=DEBUGRefine the search further by input name or time range to narrow the results to a specific run.
To verify the execution status of each input, look up the
inputs_metadata_lookupKV store.| inputlookup inputs_metadata_lookupThe lookup contains one record per configured input. Each record captures the following fields:
Field Description configuration_name Name of the account configuration associated with the input. historical_fetch_date Start date used the last time Enable Historical Fetch was set on the input. Empty if a historical fetch has not been run. historical_fetch_pending Status indicating whether a historical fetch is pending. input_name Name of the input. last_successful_execution_time Timestamp of the most recent successful execution of the input. status Outcome of the most recent execution: successorfailure.status_message Detail message for the most recent execution, including error context if the run failed. . After you have diagnosed the issue, return to the Logging tab and reset Log level to INFO to stop emitting verbose entries.
Result
You have collected the diagnostic information needed to identify why an input failed or returned unexpected results. Provide the relevant log entries and the input's metadata record when raising a support case or working with the add-on team.
Parent Topic:TISC add-on for Splunk overview
Related topics