topic Re: Splunk Add-on for Cisco IPS 2.1.3 and Splunk 6.2.3: Why am I getting an error when adding a device? in All Apps and Add-ons

Splunk Add-on for Cisco IPS 2.1.3 and Splunk 6.2.3: Why am I getting an error when adding a device?

mduckett — Thu, 28 May 2015 07:58:24 GMT

Hi,

I have Splunk 6.2.3 and the Splunk Add-on for Cisco IPS 2.1.3 and I cannot get the IPS added. When I try and add it, Splunk shows:

Encountered the following error while trying to update: In handler 'localapps': Error while posting to url=/servicesNS/nobody/Splunk_TA_cisco-ips/admin/cisco_ips_setup/cisco_ips_setup_settings

I have tried the various workarounds posted about changing TLS/SSL, but no joy. I saw one mention of the IPS version, ours is 7.1 should this work?

Thanks,

Re: Splunk Add-on for Cisco IPS 2.1.3 and Splunk 6.2.3: Why am I getting an error when adding a device?

jcoates_splunk — Sat, 30 May 2015 21:56:35 GMT

This sort of thing is usually about REST connections between the browser and Splunk... diagnosing what the problem is requires some knowledge of platform and environment. You should probably open a support case.

Re: Splunk Add-on for Cisco IPS 2.1.3 and Splunk 6.2.3: Why am I getting an error when adding a device?

mduckett — Tue, 02 Jun 2015 06:52:54 GMT

Ok, thanks I'll do that. I did update the IPS add-on 2.1.4 but am still seeing the same.

Re: Splunk Add-on for Cisco IPS 2.1.3 and Splunk 6.2.3: Why am I getting an error when adding a device?

jcoates_splunk — Sun, 07 Jun 2015 15:24:36 GMT

The troubleshooting guide is here: http://docs.splunk.com/Documentation/AddOns/latest/CiscoIPS/Troubleshooting

Re: Splunk Add-on for Cisco IPS 2.1.3 and Splunk 6.2.3: Why am I getting an error when adding a device?

kmanson — Wed, 17 Feb 2016 00:32:51 GMT

I had the same error, but mine was just file permissions. Changed the app's owner:group to splunk and the was able to save successfully.

Re: Splunk Add-on for Cisco IPS 2.1.3 and Splunk 6.2.3: Why am I getting an error when adding a device?

hochit — Tue, 29 Sep 2020 10:42:06 GMT

From my point of view, this is the app problem couldn't update setting after first set.
If you go file system and remove these files, restarted Splunk. Then you can reset/correct IP, credentials with the error.

$SPLUNK_HOME/etc/apps/Splunk_TA_cisco-ips/local
app.conf

inputs.conf

passwords.conf

Re: Splunk Add-on for Cisco IPS 2.1.3 and Splunk 6.2.3: Why am I getting an error when adding a device?

bbiandov — Fri, 19 Aug 2016 14:33:52 GMT

Any joy on this issue so far?

Re: Splunk Add-on for Cisco IPS 2.1.3 and Splunk 6.2.3: Why am I getting an error when adding a device?

agadayev — Mon, 01 May 2017 15:35:10 GMT

Might need to add "edit-scripted" capability to the Role you are doing this with.