Splunk Cisco IPS Setup

[promax]

Hello, Just started using Splunk, i added two sensors through the web setup of Cisco IPS. I don't see any IPS data in splunk yet. For trouble shooting a did a search with:

index="_internal" sourcetype="sdee_connection" 

and get the error message:

ERROR - Connecting to sensor - 10.90.99.52: ExpatError: not well-formed (invalid token): line 5, column 192

I don't get the meaning of this error, can someone help?

Thanks,
Leon

[dleung]

Hi Leon, it looks like there might be some special characters in the IPS data that is not parsing correctly. We can further examine with sample XML export of the IPS data. Can you please contact Splunk support and we can go from there. Thanks, Danny.