Splunk Cisco Firewalls

[mathewboarman]

Just reinstalled Splunk for Cisco Firewalls and restarted...

Not seen this error before... Any suggestions?

received event for unconfigured/disabled/deleted index='firewall' with source='source::DirectSysLogMessages' host='host::173.30.4.67' sourcetype='sourcetype::syslog' (1 missing total

thanks

[josemanuel]

Please explain the process of installing of Cisco firewall apps. I am still could not install it.

[sbrant_splunk]

This error shows up when you're gathering data via an input that specifies an index that does not exist on the indexer. You mentioned that you reinstalled the Cisco Firewalls app and restarted, so you should have the index on your search head. Do you also have an indexer? You'll need to create the index (one named firewall in this case) on the indexer as well.