Real time mode not working. I get an error - the dataset 'Cisco_IOS_Event' has no field 'index'.

[jlstanley]

the non real time mode works fine. any ideas why I would get this error? the sourcetype is cisco:ios not sure why it would need the index and if it did, would the datamodel already have it in it by default?

[mikaelbje]

This should be fixed in the latest version which is 2.5.6 without having to do any customizations. Please let me know if this is not the case.

[splunkseen]

The way I resolved this issue was to do the following

Go to "Data models" choose the Cisco app from the app drop down menu,
Click "Cisco_IOS_Event" > on the far right click the "Add Field" drop down and click "Auto Extracted",

You should then get a list of the available fields,
I then just selected the index field and hit save.

[squigley]

Did you ever find a resolution to this? I'm having this exact same issue.