Join the Conversation
- Find Answers
- :
- Apps & Add-ons
- :
- All Apps and Add-ons
- :
- All Apps and Add-ons
- :
- Re: IPS app not working.
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
IPS app not working.
I had it working, barely. One IPS module was reporting even though I had six I was trying to get data from. So I installed an update that appeared in the manager and that broke the app completely. I deleted the app folder and restarted Splunk, then I tried a fresh install of the app. Now I get a message that says the app is awaiting setup. I click the setup link and am prompted for the ip and credentials to add the sensor. When I enter the information and click save, I get this message.
Encountered the following error while trying to update: In handler 'localapps': Failed to search for existing Cisco IPS Sensor credential in app.conf!
I've no idea what this means. I hope somebody can help me.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where is local/app.conf?
The server is Ubuntu.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What operating system are you running on your Splunk server?
I tried to reproduce the error myself, but I can't. I tried removing and readding the app several different ways, but it worked every time. Here are a few things you can try.
- Check permissions on local/app.conf
- Are there any strange/foreign characters in local/app.conf?
- Add a blank local/app.conf if one does not exist
- Restart Splunkd
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Sorry, I meant $SPLUNK_HOME\etc\apps\Splunk_CiscoIPS\local\app.conf
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Where is local/app.conf?
The server is Ubuntu.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Index This | What travels the world but is also stuck in place?
Discover New Use Cases: Unlock Greater Value from Your Existing Splunk Data
Continue Your Journey: Join Session 2 of the Data Management and Federation Bootcamp ...
