Cisco app not showing any data but receiving logs

[haleyh44]

The cisco app shows no data from the syslog but if i run a search my network devices are sending syslogs to the correct indexer. 

UDP:514 - cisco:ios

My splunk infrastructure is just a single server preforming all functions.

Please give me some suggestions to troubleshoot! I have tried deleting the data inputs are readding but with no luck.

[richgalloway]

Make sure the Cisco IOS TA is installed and enabled.  If it is, go to Settings->Event types and make sure the eventtype itself is enabled.

[haleyh44 · Accepted solution]

I re-downloaded the TA_cisco-ios add on and it finally started working! I think the one i downloaded to install offline may have not gotten all the files needed. 

[haleyh44]

So i just tried to search for the eventtype cisco_ios and its telling me it does not exist or is disabled? Any suggestions on how i get that eventype enabled?

[richgalloway]

Apparently, the Cisco app is not performing the same search you are performing manually.  Examine the searches the app uses (click the magnifying glass icon on a panel or use the CLI to view the dashboard code) and compare it to your manual search.  Based on your findings, adjust how the data is onboarded or modify the queries.