All Apps and Add-ons

Cisco app not showing any data but receiving logs

haleyh44
Explorer

The cisco app shows no data from the syslog but if i run a search my network devices are sending syslogs to the correct indexer. 

UDP:514 - cisco:ios

My splunk infrastructure is just a single server preforming all functions.

 

Please give me some suggestions to troubleshoot! I have tried deleting the data inputs are readding but with no luck.

Labels (1)
0 Karma
1 Solution

haleyh44
Explorer

I re-downloaded the TA_cisco-ios add on and it finally started working! I think the one i downloaded to install offline may have not gotten all the files needed. 

View solution in original post

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Make sure the Cisco IOS TA is installed and enabled.  If it is, go to Settings->Event types and make sure the eventtype itself is enabled.

---
If this reply helps you, Karma would be appreciated.
0 Karma

haleyh44
Explorer

I re-downloaded the TA_cisco-ios add on and it finally started working! I think the one i downloaded to install offline may have not gotten all the files needed. 

0 Karma

haleyh44
Explorer

So i just tried to search for the eventtype cisco_ios and its telling me it does not exist or is disabled? Any suggestions on how i get that eventype enabled?

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Apparently, the Cisco app is not performing the same search you are performing manually.  Examine the searches the app uses (click the magnifying glass icon on a panel or use the CLI to view the dashboard code) and compare it to your manual search.  Based on your findings, adjust how the data is onboarded or modify the queries.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...