Cisco Security Suite visualization issue

wdeoliveira_spl — Mon, 28 Sep 2020 16:28:59 GMT

Hello all,

I am collecting Cisco IronPort WSA events on Splunk 6.

The events got indexed at Splunk, and can be visualized via Search App.

However I am able not to visualize any data using from the Cisco Security Suite (http://apps.splunk.com/app/525/ in conjunction with the Splunk_TA_cisco-wsa).

We have been trying different índex and sourcetype configurations but they don’t seem to be working.

Have you any of one of you have found similar problems in the past? Any standard índex and sourcetype specification recommended?

Thanks-

Wellington

Re: Cisco Security Suite visualization issue

jconger — Mon, 28 Apr 2014 15:08:44 GMT

Do you get results using the following search?

eventtype=cisco-wsa*

Also, did you copy the SA-cisco-wsa folder to $SPLUNK_HOME/etc/apps ?

topic Cisco Security Suite visualization issue in Security

Cisco Security Suite visualization issue

Re: Cisco Security Suite visualization issue