All Apps and Add-ons

Splunk Cisco Firewalls


Just reinstalled Splunk for Cisco Firewalls and restarted...

Not seen this error before... Any suggestions?

received event for unconfigured/disabled/deleted index='firewall' with source='source::DirectSysLogMessages' host='host::' sourcetype='sourcetype::syslog' (1 missing total


0 Karma

New Member

Please explain the process of installing of Cisco firewall apps. I am still could not install it.

0 Karma

Splunk Employee
Splunk Employee

This error shows up when you're gathering data via an input that specifies an index that does not exist on the indexer. You mentioned that you reinstalled the Cisco Firewalls app and restarted, so you should have the index on your search head. Do you also have an indexer? You'll need to create the index (one named firewall in this case) on the indexer as well.

0 Karma