Skip to content

Troubleshoot the Splunk Add-on for CyberArk EPM

For troubleshooting tips that apply to all add-ons, see Troubleshoot add-ons in Splunk Add-ons. For additional resources, see Support and resource links for add-ons in Splunk Add-ons.

Delay in data ingestion

Before performing the task below, verify that you provided the correct CyberArk EPM account information and that your inputs are configured correctly.

Verify your API call limits:

  1. Go to Configuration > Logging and set the log level to DEBUG.

  2. Execute:

    index="_internal" source="*splunk_ta_cyberark_epm*" "EPM API rate limit reached"

  3. Check for the following log message:

    EPM API rate limit reached: <details>. Retrying after 10 seconds.

    This message indicates that the input is working but it is hitting the API call limit of your account. The add-on retries automatically.

  4. To increase the API limit for your account, contact CyberArk Support at support@cyberark.com.

See the CyberArk documentation for more details on API limitations at https://community.cyberark.com/s/article/EPM-RestAPI-Limitations.

The add-on includes built-in saved searches for detecting operational issues such as API rate limits. For details, see Alerts.

Data is not ingested in Splunk

For best results when experiencing data ingestion or collection issues, use the latest supported version of the Splunk Add-on for CyberArk EPM.

  • Verify Account and Inputs are configured properly.
  • Verify KV Store is enabled and working.
  • Check that data is available within the time range. By default, the add-on starts collecting the data generated within the last 6 minutes on the EPM server. After that, it collects the data as per the last ingested event.
  • To collect historical data, you can utilize the “Start Date” field provided in the new inputs.

Note

See CyberArk EPM API limitation documentation for details regarding number of allowed API calls within a time range.

Event truncation

For sourcetype cyberark:epm:policies, when the user selects collect_policy_details option to collect the details of the policy, then it might happen that the event gets truncated because the policy details are more in length but Splunk allows an event of maximum 10k bytes.

Issue with account configuration

  • If “EPM server cannot process the request. Bad Request” error is encountered in the UI during account configuration, make sure there is no whitespace in the username field.
  • If “Could not connect to <url>. Check configuration and network settings.” error is encountered in the UI during account configuration, make sure that the EPM server can be reached and the URL does not contain any whitespace or path components.
  • To further troubleshoot any issue, check the logs file.