Splunk 6.6 and Meraki TA are no longer mapping events with latest CIM of 4.10

[brian1_tate]

Hi all,

I am having an issue getting Cisco Meraki events to appear in Splunk 6.6 with the latest CIM installed of 4.10. I see the app was designed some time ago and is supported on older versions, however I need to keep my CIM at least 4.9 to work with newer TA's of other solutions.

I have in the past basically installed the app on search head and sent the data over syslog without issue, other than in ESS. However, at this moment, I only get the data but without fields or tags mapped. This will certainly impact usage in any Splunk security app. Here's the TA and what it has:

https://splunkbase.splunk.com/app/3018/#/details

Is there any means to get this to at least 4.8 and 4.9 compatibility @myron.davis ?

[brian1_tate · Accepted solution]

So I ended up looking at what input.conf was actually in the local directory, when there was none listed - it explained what I saw in the data summary. These did exist in the TA under etc/apps and in the default directories but not in the primary local. After adding this and adding the line for ucp 514 along with source and sourcetype to be used, the events magically aligned. I would have thought adding this as an input with these parameters would have added a line and the same information I used to create the input and ensure data was going to the same index but it appears not.

Therefore, the best thing I can recommend for those running into this is to check inputs and props, regardless if it's a single instance and ensure there are settings in the local directories to override any others.