https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79663#M16360 <P>Here are some troubleshooting tips:</P> <P>-- Windows Firewall</P> <P>Make sure that if you installed Splunk on a Windows box that the Windows firewall is not blocking UDP 514. </P> <P>-- Firewall</P> <P>Make sure that when you setup syslog that the destination ip address for the syslog traffic is the Splunk server</P> <P>-- Restart Splunk</P> <P>Make sure that you restart the Splunk processes/services when you install the Cisco Security Suite. </P> Wed, 29 Feb 2012 22:10:42 GMT tgow 2012-02-29T22:10:42Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79658#M16355 <P>I've installed the Cisco Firewalls app. My colleague has pointed the firewall to the splunk server:port. There is no option to start the app and there appears to be no logging taking place. How do I get this working?</P> Mon, 27 Feb 2012 19:10:56 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79658#M16355 rblalock 2012-02-27T19:10:56Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79659#M16356 <P>Do you have setup an data input for syslog (udp(514)?</P> Mon, 27 Feb 2012 19:58:12 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79659#M16356 Spelunke 2012-02-27T19:58:12Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79660#M16357 <P>Yes. (message padding)</P> Mon, 27 Feb 2012 20:01:13 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79660#M16357 rblalock 2012-02-27T20:01:13Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79661#M16358 <P>Make sure that you install the Cisco Security Suite first. </P> <P><A href="http://splunk-base.splunk.com/apps/22300/cisco-security-suite">http://splunk-base.splunk.com/apps/22300/cisco-security-suite</A></P> <P>If you have already created the data input then just save the configuration page with the defaults. </P> <P>Now you will need to restart Splunk from either the Manager or from the command line.</P> <P>The Cisco for Firewall app needs the default dashboards that are shipped with the Cisco Security Suite. </P> Mon, 27 Feb 2012 20:29:38 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79661#M16358 tgow 2012-02-27T20:29:38Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79662#M16359 <P>Installed the Cisco security suite, and it appears to be working. But I don't see my firewall anywhere. It could be that it simply is not generating traffic. (Set to logging level "Warnings") But shouldn't I at least be able to see my firewall listed somewhere?</P> Tue, 28 Feb 2012 13:11:51 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79662#M16359 rblalock 2012-02-28T13:11:51Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79663#M16360 <P>Here are some troubleshooting tips:</P> <P>-- Windows Firewall</P> <P>Make sure that if you installed Splunk on a Windows box that the Windows firewall is not blocking UDP 514. </P> <P>-- Firewall</P> <P>Make sure that when you setup syslog that the destination ip address for the syslog traffic is the Splunk server</P> <P>-- Restart Splunk</P> <P>Make sure that you restart the Splunk processes/services when you install the Cisco Security Suite. </P> Wed, 29 Feb 2012 22:10:42 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79663#M16360 tgow 2012-02-29T22:10:42Z https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79664#M16361 <P>Doh windows firewall was the solution for us on why this wasnt working. I even installed MS Net mon and was seeing traffic on the interface.</P> Fri, 30 Nov 2012 22:14:47 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-get-Cisco-App-working/m-p/79664#M16361 entmgmt 2012-11-30T22:14:47Z