topic Re: Cisco App has stopped working after a recent "upgrade" in All Apps and Add-ons

Cisco App has stopped working after a recent "upgrade"

DBattisto — Tue, 29 Sep 2020 23:05:31 GMT

I recently changed some things around our Splunk instance at the request of my customer. On our production system, there were no issues. But when I went back to clean up the lab side, I noticed that the Cisco App stopped working.

On the main page, it only displays port flapping, but nothing else. When I go manually search for sourcetype="cisco:ios", I get thousands of results.

The only thing that I changed was splitting up which port our switches and routers send syslogs to. Again, they appear to be indexing properly and are getting tagged as 'cisco:ios'.

Any suggestions? Thanks!

Edit: One year later (almost to the day), I encountered the same issue but had a different cause/solution. I have the TA-Cisco-ios and Splunk_TA_nix running on my searchhead. The incoming Cisco events were being tagged with the eventtype 'nix-all-logs' due to a configuration in Splunk_TA_nix. To fix this issue, I had to create a local copy of 'eventtypes.conf' for Splunk_TA_nix and specify that several of the *nix eventtypes should only be drawn from the linux index. It fixed my issues, my Cisco events were tagged properly, and the app worked again.

Re: Cisco App has stopped working after a recent "upgrade"

vinod94 — Wed, 06 Feb 2019 06:58:23 GMT

have you tried rebuilding data model?

Re: Cisco App has stopped working after a recent "upgrade"

DBattisto — Wed, 06 Feb 2019 13:15:28 GMT

Thanks for the suggestion! I'm afraid I'm not familiar with that process. Do you have a good link to follow? This is what I've found on data models, and am not sure if this is what you're referring to:
https://docs.splunk.com/Documentation/Splunk/7.2.3/Knowledge/Managedatamodels

Re: Cisco App has stopped working after a recent "upgrade"

vinod94 — Tue, 29 Sep 2020 23:11:00 GMT

Hi mate,

You can go to settings>under Knowledge - Data models . Search for Cisco_ios_event. Expand (>)and you will see an update and rebuild option.

If it still doesn't work, you can try this - try mentioning the index name(your index) if its not present in the eventtypes and macros.

Re: Cisco App has stopped working after a recent "upgrade"

DBattisto — Wed, 20 Feb 2019 00:12:46 GMT

Late reply: I did not see the 'update and rebuild' option. The problem is still occurring, but I have not had time to troubleshoot much.

Re: Cisco App has stopped working after a recent "upgrade"

vinod94 — Wed, 20 Feb 2019 06:12:20 GMT

Hi @DBattisto ,

it should be der,

please see the image for the reference,

Re: Cisco App has stopped working after a recent "upgrade"

DBattisto — Wed, 20 Feb 2019 13:12:17 GMT

Upgraded to 7.2.4 and saw it. Now it works again. Thank you!!

Re: Cisco App has stopped working after a recent "upgrade"

vinod94 — Sun, 09 Feb 2020 18:37:48 GMT

Glad it worked for you 🙂