All Apps and Add-ons

Splunk Add-on for Cisco IPS: How many Cisco IPS devices/sensors can we add, and how can we find which ones are consuming more resources?

Path Finder

What is the max number of Cisco IPS devices/sensors we can add?
I have added 40+ devices, and system became bit slow.
Can we know which thread IPS sensor/Device thread is consuming more resources?
What is the Max log storage supported per Cisco IPS device?

0 Karma

Splunk Employee
Splunk Employee

I would add them until collection slows down, and then add a second forwarder. We don't have several dozen Cisco IPS's, but in other API-based data collection tasks the slow-down point is somewhere between 10 and 30 devices.

I'd use a search like this to find your connections, then pipe it through transaction, then use stats. You might have to eval to find elapsed time.

index=_internal source=*Splunk_TA_cisco-ips*
0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.