topic received event for unconfigured/disabled/deleted index='firewall' with source='source::udp:5447' host='host::x.x.x.x' sourcetype='sourcetype::cisco:asa' (1 missing total) in Monitoring Splunk

received event for unconfigured/disabled/deleted index='firewall' with source='source::udp:5447' host='host::x.x.x.x' sourcetype='sourcetype::cisco:asa' (1 missing total)

ionitsupport — Mon, 28 Sep 2020 13:11:55 GMT

Can't get this working with Splunk for Cisco ASA

Set ASA 5505 to forward syslog to usp/5447 with timestamps enabled

:/opt/splunk/etc/apps/Splunk_for_CiscoASA/local/inputs.conf show this:

[udp://5447]
connection_host = ip
sourcetype = syslog

Still get:
received event for unconfigured/disabled/deleted index='firewall' with source='source::udp:5447' host='host::x.x.x.x' sourcetype='sourcetype::cisco:asa' (1 missing total)

This is a vanilla install on Ubuntu 12.04, same issue on Windows 2012 so should not be OS specific.

I'd really appreciate if someone could bulletpoint steps taken for the benefit of all... thanks! 🙂

Did follow install notes:
Installation Notes

Pre-requisites;
- TA-cisco_asa (1.1)
- SideView Utils (used 1.3.5 not 2.x)
- Google Maps(1.1.2)

Re: received event for unconfigured/disabled/deleted index='firewall' with source='source::udp:5447' host='host::x.x.x.x' sourcetype='sourcetype::cisco:asa' (1 missing total)

yannK — Tue, 29 Jan 2013 07:31:32 GMT

the answer is in the title : received event for unconfigured/disabled/deleted index='firewall'
please create the index "firewall" in your indexer !

Re: received event for unconfigured/disabled/deleted index='firewall' with source='source::udp:5447' host='host::x.x.x.x' sourcetype='sourcetype::cisco:asa' (1 missing total)

ionitsupport — Tue, 29 Jan 2013 19:28:10 GMT

Thanks, error message is gone. 😉

But I still don't get anything in Splunk for Cisco ASA app.
With all due respect I thought based on the Install notes I could get this working but I must be missing something.

Firewall index shows 311 events.

Could you please let me know the next step or point me to a guide?

Re: received event for unconfigured/disabled/deleted index='firewall' with source='source::udp:5447' host='host::x.x.x.x' sourcetype='sourcetype::cisco:asa' (1 missing total)

pmcquaid — Thu, 13 Feb 2014 23:08:19 GMT

I also had this same issue. To fix it I had to do 2 things.

1.) Create an index named firewall
2.) Add this index to the "Indexes searched by default" section which is under Manager->Access Controls->Roles->Select the appropriate role.

This was done with v 5.0.4 of Splunk

I hope this is helpful.