All Apps and Add-ons

Cisco events not matched

duane_wylie
Observer

I have some syslog messages coming from my Cisco devices that are not being identified by the TA. How would I go about extending the app to capture these messages?

0 Karma

mikaelbje
Motivator

Some IOS XR devices have a slightly different log format. I've made some changes to the app to also capture those events. Could you please try the latest version of the app (currently 2.0.0) and see if they're matched now?

0 Karma

duane_wylie
Observer

Here are a few of the entries that are coming in from my Cisco devices that are not matching against the TA_cisco-ios Splunk App. These are coming in from ASR9K IOS-XR devices.

Feb 27 14:33:24 XX.XX.XX.XX 516048: RP/0/RSP1/CPU0:Feb 27 14:33:24.336 CST: exec[65788]: %SECURITY-login-4-AUTHEN_FAILED : Failed authentication attempt by user 'USERNAME' from 'YY.YY.YY.YY' on 'vty0'

Feb 27 14:29:04 XX.XX.XX.XX 138890: LC/0/1/CPU0:Feb 28 02:29:41.007 UTC: ntpdc[207]: %IP-IPNTP-5-SYNCLOSS : Synchronization lost : DLRSC node : The clock was stepped and needs to be resynced

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...