topic Re: Cisco Apps in Getting Data In

Cisco Apps

aalaa — Fri, 15 Mar 2019 08:26:34 GMT

Hello ,

Have you any suggestions for cisco apps to monitor events cisco routers and switches ?

Ps:
I installed the application cisco networks but the dahsboard not all functional

Re: Cisco Apps

p_gurav — Fri, 15 Mar 2019 08:40:12 GMT

Did you install Cisco Networks Add-on? Is your splunk environment distributed or single instance?

Re: Cisco Apps

MoniM — Fri, 15 Mar 2019 08:41:40 GMT

Hi @aalaa ,
Can you confirm if you have installed Cisco Networks Add-on for Splunk Enterprise also?
Here is the link to download it:- https://splunkbase.splunk.com/app/1467/

Thanks.

Re: Cisco Apps

aalaa — Fri, 15 Mar 2019 08:57:36 GMT

Yes i do , i install it in the indexer

Re: Cisco Apps

aalaa — Fri, 15 Mar 2019 08:59:09 GMT

@MoniM yes i do but same result

Re: Cisco Apps

molinarf — Thu, 02 May 2019 22:47:04 GMT

Can you attach a screenshot of what you are of the dashboard?
Try going to Search and Reporting, then clicking on data summary to see if your devices are sending syslog data. If you see the device IP address or hostname, click on it and then see what kind of source or sourcetype information you are getting. You should see udp:514 or whatever port you have configured for your network devices to send syslogs to.

Re: Cisco Apps

adonio — Tue, 14 May 2019 01:09:15 GMT

the Cisco Network app and the relevant TA works beautifully in dozens of environments i worked on
https://splunkbase.splunk.com/app/1467/
https://splunkbase.splunk.com/app/1352/
@aalaa if there is something you cant figure out, please elaborate so we can better assist you

Re: Cisco Apps

eliasit — Mon, 12 Aug 2019 21:05:46 GMT

I had the same problem with the Cisco Security Suite. (https://splunkbase.splunk.com/app/525/)

Everything was installed and setup correctly but the dashboards always said "No results" or "No data". I found a fix for it when looking into why the "Data Summary" button on the search page was not showing the cisco:asa source type. Long story short, for some searches, not all indexes are included by default. New/created indexes, by default, are not included. So if you followed the Cisco docs and created an index called "asa_syslog" you need to add that index to the default search list. This is also true for other created indexes such as "oswinsec".

This is set in Setting>Access Controls>Roles. Select the role that your user belongs to, in my case admin, then click the "Indexes" tab. Enable both the "Included" and "Default" checkboxes for the index to make it searchable by default. After I added the index I went back to Cisco Security Suite and the dashboards populated immediately.