Currently, the Splunkbase page for the Splunk Add-on for Cisco IPS only shows support up through 6.3
Per the docs, the current version of the add-on cannot connect to Cisco IPS from Splunk platform version 6.4. It's a known issue.
http://docs.splunk.com/Documentation/AddOns/released/CiscoIPS/Releasenotes
Cisco IPS 2.1.6 was just released today (Aug. 9) and the previous problem with connecting to Splunk platofrm 6.4 has been fixed in the latest version: http://splunkbase.splunk.com/app/1903
Per the docs, the current version of the add-on cannot connect to Cisco IPS from Splunk platform version 6.4. It's a known issue.
http://docs.splunk.com/Documentation/AddOns/released/CiscoIPS/Releasenotes
Thanks, I didn't think to check the release notes. I was hoping it was just an older version that hadn't been tested yet.
Please check out the latest release of Cisco IPS (http://splunkbase.splunk.com/app/1903 ), which has fixed the issue of failing to connect to Splunk 6.4. Thanks!
See my recent post regarding 6.4 and IPS - I have it working - no problems .