In the Cisco IOS Auditing -> Event Analysis page, the vendor explanations and recommended actions are finding matching events, but the transforming command is showing no results.
The query is as follows (the bolded portion is where the query returns no results):
tstats count AS "Count of Cisco IOS Event" from datamodel=Cisco_IOS_Event where (nodename = Cisco_IOS_Event) groupby "Cisco_IOS_Event.vendor_explanation" prestats=true | stats dedup_splitvals=t count AS "Count of Cisco IOS Event" by "Cisco_IOS_Event.vendor_explanation" | sort limit=250 -"Count of Cisco IOS Event" | fields - _span | rename "Cisco_IOS_Event.vendor_explanation" AS vendor_explanation | fillnull "Count of Cisco IOS Event" | fields vendor_explanation, "Count of Cisco IOS Event"****
Is there something that I need to enable on the supported equipment to help this search run?
BTW: Excellent app.
I found out that on my Splunk 6.12 Windows installation, the limits.conf file has problems with lookup tables greater than 10M.
In talking with support, I was able to fix this issue:
Navigate to $SPLUNK_HOME/etc/system/local Create a limits.conf file
Add or change the following stanza and value:
max_memtable_bytes = 50000000 (this will change it from the default setting of 10MB to 50MB)
This fixed the lookup issue, and I am now getting vendor_explanation correlations.
I've tried your solution on Splunk 6.1.3 running on Windows Server 2012 R2 Standard but still can't get the vendor_explanation populated. Are you sure you didn't have to configure anything else?
Another update. I did the following and got it working on a Windows server:
So here's an update after a week of Support Rotation in London. yannK and you provided me with the fix, although we do not really know the exact reason we hit the issue.
This fixed it! However as a general best practice I also added the following
this is a new feature so there might be issues with it.