All Apps and Add-ons

Splunk 6.6 and Meraki TA are no longer mapping events with latest CIM of 4.10

brian1_tate
Path Finder

Hi all,

I am having an issue getting Cisco Meraki events to appear in Splunk 6.6 with the latest CIM installed of 4.10. I see the app was designed some time ago and is supported on older versions, however I need to keep my CIM at least 4.9 to work with newer TA's of other solutions.

I have in the past basically installed the app on search head and sent the data over syslog without issue, other than in ESS. However, at this moment, I only get the data but without fields or tags mapped. This will certainly impact usage in any Splunk security app. Here's the TA and what it has:

https://splunkbase.splunk.com/app/3018/#/details

Is there any means to get this to at least 4.8 and 4.9 compatibility @myron.davis ?

0 Karma
1 Solution

brian1_tate
Path Finder

So I ended up looking at what input.conf was actually in the local directory, when there was none listed - it explained what I saw in the data summary. These did exist in the TA under etc/apps and in the default directories but not in the primary local. After adding this and adding the line for ucp 514 along with source and sourcetype to be used, the events magically aligned. I would have thought adding this as an input with these parameters would have added a line and the same information I used to create the input and ensure data was going to the same index but it appears not.

Therefore, the best thing I can recommend for those running into this is to check inputs and props, regardless if it's a single instance and ensure there are settings in the local directories to override any others.

View solution in original post

0 Karma

brian1_tate
Path Finder

So I ended up looking at what input.conf was actually in the local directory, when there was none listed - it explained what I saw in the data summary. These did exist in the TA under etc/apps and in the default directories but not in the primary local. After adding this and adding the line for ucp 514 along with source and sourcetype to be used, the events magically aligned. I would have thought adding this as an input with these parameters would have added a line and the same information I used to create the input and ensure data was going to the same index but it appears not.

Therefore, the best thing I can recommend for those running into this is to check inputs and props, regardless if it's a single instance and ensure there are settings in the local directories to override any others.

0 Karma
Get Updates on the Splunk Community!

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...

DevSecOps: Why You Should Care and How To Get Started

 WATCH NOW In this Tech Talk we will talk about what people mean by DevSecOps and deep dive into the different ...