How to verify that Splunk_IPS plugin is working

[rnutter]

I am trying to get the Splunk_IPS plugin to work. I cant see that it is trying to get SDEE data from the IPS sensors. Using Cisco's IPSME app, I can verify that the sensor is sending out data.

Wasnt sure if short of using wireshark that there was any way to tell that the plugin is working ?
I found the config file and verified that it was using the correct account and password are being used.

Thanks,
Ron

[jbsplunk]

All Time, Real Time search is your friend. How is the data getting into splunk? I would try doing a search for either the source or sourcetype over all time, real time. This will show you what exactly is coming into Splunk via the search app. It could be that the data doesn't have the proper sourcetype/source applied to it and therefore isn't matching the criteria specified by the search in the app.