topic Re: Splunk Add-on for Cisco ASA in Getting Data In

Splunk Add-on for Cisco ASA

vmicovic2 — Wed, 30 Sep 2020 02:20:25 GMT

hi, after installing this plugin, i have errors on every search, realted to cisco or not...
Always see this errors:
Could not load lookup=LOOKUP-cisco-asa-action_lookup
Could not load lookup=LOOKUP-cisco-pix-action_lookup
Could not load lookup=LOOKUP-cisco_fwsm_action_lookup

i see this search is located in /opt/splunk/etc/apps/Splunk_TA_cisco-asa/default/props.conf but not sure what need to change to fix this?

thank you.

Re: Splunk Add-on for Cisco ASA

broberg — Wed, 25 Sep 2019 11:35:25 GMT

This is a permission error in some way.
Sometime it is becuase a user have shared something globally.

When an app have the error it is often that it is not shared globally or not shared to the correct users, or from the wrong app.

Apps -> Manage Apps -> Sharing -> Permission

It can also be a good idee to search for the lookup yourself from other apps or the same and see if it will give you some hints)
Settings -> Lookups -> Lookup Definitions and search for the reported lookup. There you will see the name of the lookup file being used and the app which should own it. Create/replace the lookup file with the same name in that app

Re: Splunk Add-on for Cisco ASA

vmicovic2 — Wed, 25 Sep 2019 11:38:45 GMT

hi, i added to everyone write permission but it is the same, still get errors... 😕

Re: Splunk Add-on for Cisco ASA

broberg — Wed, 25 Sep 2019 13:39:58 GMT

How about read permission? And is it shared globally and not just in app?

Re: Splunk Add-on for Cisco ASA

vmicovic2 — Thu, 26 Sep 2019 08:40:32 GMT

i think this is ok?

Re: Splunk Add-on for Cisco ASA

broberg — Thu, 26 Sep 2019 10:58:36 GMT

Yes, that is correct.

Re: Splunk Add-on for Cisco ASA

vmicovic2 — Thu, 26 Sep 2019 11:36:37 GMT

and? 🙂
what can i do next?

do you have this addon?

Re: Splunk Add-on for Cisco ASA

broberg — Thu, 26 Sep 2019 13:13:33 GMT

What happens when you search for the lookup from an other app, or the same?

Go to Settings -> Lookups -> Lookup Definitions and search for the reported lookup. There you will see the name of the lookup file being used and the app which should own it. Create/replace the lookup file with the same name in that app and the error will go away (its worth a test)

And try change the permission on the other way so they are not shared globally only in app, but everyone can read them.

Re: Splunk Add-on for Cisco ASA

broberg — Thu, 26 Sep 2019 13:21:14 GMT

I updated my answer.
I have the app shared globally with everyone read and admin to write.
It maybe some local config errors on the lookup so try if you can use them urself.

Re: Splunk Add-on for Cisco ASA

vmicovic2 — Thu, 26 Sep 2019 14:11:25 GMT

nothing changed. Cannot understand what i need to do in lookup definitions?
all seems fine by me 😄
i found post with similar case, but don`t understand what he changed: https://answers.splunk.com/answers/774032/splunk-add-on-for-cisco-asa.html

Re: Splunk Add-on for Cisco ASA

vmicovic2 — Mon, 07 Oct 2019 09:55:01 GMT

seems it is not issue with rights ...

Re: Splunk Add-on for Cisco ASA

RCA — Thu, 21 Mar 2024 14:14:44 GMT

Check your local.meta file at the following path:

/opt/splunk/etc/apps/Splunk_TA_cisco-asa/metadata

and look for this stanza

[lookups] access = read : [ power, sc_admin ], write : [ ess_analyst, power, sc_admin ] export = system version = 9.1.2308.201 modtime = 1710775209.916764000

then add the role to the access like so:

access = read : [ user ,power, sc_admin ]

If this answer helped, let me know.