All Apps and Add-ons

Cisco AMP for Endpoints Events Input - why am I not getting any data in the "New Input" tab?


I am running Splunk Version 6.5.0 on Linux

I have installed Cisco AMP for Endpoints Events Input ( on my indexer and filled out the configuration field with my API host , API id, and API key. However, when I go to the "new inputs" tab it just says "please wait..." nothing is populating within the app. I can make an API call using curl and see that I can get data from Cisco AMP for endpoints. Has anybody else had this problem with the app or a potential solution? Any help would be most appreciated!



hey kbabwah,

I am going through this right now myself.

In this file:


find the line #11:

sys.path.append(make_splunkhome_path(["etc", "apps", "amp4e_events_input", "bin"])) 

replace it with:

sys.path.insert(0, make_splunkhome_path(["etc", "apps", "amp4e_events_input", "bin"]))

Afterwards, please restart your Splunk instance and check if the issue persists.



I have reviewed github and made that revision but nothing happened. It is also very weird that I have no log data about it in splunkd.log. it seems to just not doing anything once I put the configurations in.

0 Karma


Are you configuring this on a forwarder or on one of your searcheads? After making the change and restarting Splunk, "$SPLUNK_HOME/bin/splunk restart" it fixed the boxes being grayed out, and allowed me to add inputs.

Unfortunately im unable to help too much beyond that. The app is developer supported, and their contact address is on their app page in splunkbase. I got a response back within a day or two and they were very helpful.

I worked with one of their developers yesterday and he mentioned compatability issues with Splunk 7, so if it is on a forwarder or serchead running 7.x, may i suggest moving it to one running 6.x if possible.

0 Karma
Get Updates on the Splunk Community!

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options

Observability Unveiled: Navigating OpenTelemetry's Framework and Deployment Options A recent Tech Talk, ...

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...