topic Re: How do I install the Cisco MARS Archive add-on? in Getting Data In

How do I install the Cisco MARS Archive add-on?

Will_Hayes — Mon, 07 Jun 2010 03:46:25 GMT

How do I install and configure the Cisco MARS archive add-on on Splunkbase?

Re: How do I install the Cisco MARS Archive add-on?

Will_Hayes — Mon, 07 Jun 2010 03:46:42 GMT

To install this add-on, unpack this file into $SPLUNK_HOME/etc/apps and restart.

http://www.splunkbase.com/apps/All/4.x/Add-On/app:Cisco+MARS+Archive+Add-on

Configure your MARS instance schedule an export of the raw message archive logs into a directory accessible by the Splunk Server.

Once the data is in a directory accessible by the Splunk server, you will need to configure a data input to monitor that directory instructions on how to configure a data input can be found here: http://www.splunk.com/base/Documentation/latest/Admin/WhatSplunkCanMonitor

When configuring the data input you will need to select manual and set cisco_mars_rm.

There is one scheduled search included in this add-on which creates an cache for the dashboard every 3 hours with a Splunk enterprise license. To change the schedule you can edit the following search under the manager:

Cisco MARS Archive - IPS - DataCube

Re: How do I install the Cisco MARS Archive add-on?

williamche — Mon, 07 Jun 2010 20:56:52 GMT

Will,

I can't find any reference to a Cisco MARS Archive add-on in Splunkbase. Where I can I get this app?

Re: How do I install the Cisco MARS Archive add-on?

Will_Hayes — Wed, 09 Jun 2010 09:56:34 GMT

Sorry about that! link: http://www.splunkbase.com/apps/All/4.x/Add-On/app:Cisco+MARS+Archive+Add-on