Cisco IOS Auditing Event Analysis

[bsafrit]

In the Cisco IOS Auditing -> Event Analysis page, the vendor explanations and recommended actions are finding matching events, but the transforming command is showing no results.

The query is as follows (the bolded portion is where the query returns no results):

tstats count AS "Count of Cisco IOS Event" from datamodel=Cisco_IOS_Event where (nodename = Cisco_IOS_Event) groupby "Cisco_IOS_Event.vendor_explanation" prestats=true | stats dedup_splitvals=t count AS "Count of Cisco IOS Event" by "Cisco_IOS_Event.vendor_explanation" | sort limit=250 -"Count of Cisco IOS Event" | fields - _span | rename "Cisco_IOS_Event.vendor_explanation" AS vendor_explanation | fillnull "Count of Cisco IOS Event" | fields vendor_explanation, "Count of Cisco IOS Event"****

Is there something that I need to enable on the supported equipment to help this search run?

BTW: Excellent app.

[bsafrit]

I found out that on my Splunk 6.12 Windows installation, the limits.conf file has problems with lookup tables greater than 10M.

In talking with support, I was able to fix this issue:

Navigate to $SPLUNK_HOME/etc/system/local Create a limits.conf file
Add or change the following stanza and value:

[lookup]
max_memtable_bytes = 50000000 (this will change it from the default setting of 10MB to 50MB)

Restart Splunk

This fixed the lookup issue, and I am now getting vendor_explanation correlations.

[mikaelbje]

I've tried your solution on Splunk 6.1.3 running on Windows Server 2012 R2 Standard but still can't get the vendor_explanation populated. Are you sure you didn't have to configure anything else?

[mikaelbje]

Another update. I did the following and got it working on a Windows server:

So here's an update after a week of Support Rotation in London. yannK and you provided me with the fix, although we do not really know the exact reason we hit the issue.

1. On the indexers I added this to limits.conf and restarted: [lookup] max_memtable_bytes = 100000000

This fixed it! However as a general best practice I also added the following

1. distsearch.conf on the search head to fix a general Windows (checksum?) issue: [replicationSettings] allowDeltaUpload = false

[mikaelbje]

Thanks for posting the solution to this issue. It's very odd that this only happens on Windows. Why would the limits be different on Windows and Linux?

[mikaelbje]

Hi Bsafrit,

this is a new feature so there might be issues with it.

• Could you please let me know what Splunk version you are running? You need to be running version 6.1.0 or higher.
• When you search for the "cisco:ios" sourcetype could you also check that you have the field "vendor_explanation" in the field list?