topic Trying to pull data from IPS using SDEE in Getting Data In

Trying to pull data from IPS using SDEE

vhallan_splunk — Wed, 21 May 2014 10:28:18 GMT

How to pull data from Cisco IPS into Splunk. I tried using SDEE pool query but it did not work.

Any help on this would be great.

(for customer kiqbal @ Sega)

Re: Trying to pull data from IPS using SDEE

alacercogitatus — Wed, 21 May 2014 11:38:35 GMT

It's old and outdated, but might work: http://apps.splunk.com/app/528/

Re: Trying to pull data from IPS using SDEE

alacercogitatus — Tue, 27 May 2014 13:54:51 GMT

If this answered your question, please accept it. Thanks!

Re: Trying to pull data from IPS using SDEE

jconger — Tue, 27 May 2014 14:51:17 GMT

You can use the app mentioned by alacercogiltatus. Take note that the app only works for Splunk version 5 and below. So, if you have Splunk 6, this app will not work out of the box. You can use a Splunk 5.x Heavy Forwarder to get information from your IPS and then forward to a Splunk 6 indexer. Or, this thread has a potential workaround for you as well to use IPS with Splunk 6 -> http://answers.splunk.com/answers/105193/cisco-ips-error-errno-8?page=1&focusedAnswerId=135759#135759