topic Re: CISCO AMP for EndPoints Connection dropping in Getting Data In

CISCO AMP for EndPoints Connection dropping

MSISplunk — Tue, 29 Sep 2020 17:43:26 GMT

I have installed the CISCO AMP CIM add-on and the CISCo Add-on for AMP for EndPoints inputs. I can create the inupts but I am not getting any data in Splunk.
I keep getting the following messages in the amp4e_events_input.log:
Connected. Starting to consume.
2018-01-15 15:28:39,399 INFO Amp4eEvents - Received response from ApiService (200)
2018-01-15 15:34:46,357 WARNING Amp4eEvents - Connection error (1516048486.36, : The AMQP connection was closed: ())! Reconnecting in about 3 seconds.

I have seen multiple INFO Amp4eEvents - Received response from ApiService (200) messages but I see no data in Splunk.

Any help anyone can offer is greatly appreciated.

Re: CISCO AMP for EndPoints Connection dropping

snort80 — Sat, 22 Sep 2018 18:55:26 GMT

Hi,

Has anyone found a solution to the above?

Thanks,

Re: CISCO AMP for EndPoints Connection dropping

ussina04 — Tue, 11 Dec 2018 06:35:13 GMT

i am also facing the issue but the logs has been written to the indexers but it will be written to index=main.

Also we have used heavy forwarder to install these apps

Re: CISCO AMP for EndPoints Connection dropping

arthurlarson — Tue, 08 Jun 2021 17:19:24 GMT

Our CiscoAMP was not showing up in Splunk until we re-downloaded the API key from the CiscoAMP portal as "Read/Write". The "read only" API key did not work. Also, we set up the logs to go to: index = "epav"

Note: we also had to re-configure the inputs after applying the R/W API by deleting the previous input.