All Apps and Add-ons

Splunk TA For Cisco ASA - event_desc and lookups/event_codes.csv missing


Just upgraded to the Splunk TA for Cisco ASA (previous Cisco Firewall) and noticed that event_desc is missing because event_codes.csv doesnt exist and was never carried over. Any reason why this is the case?

Also the error_code field extraction is missing too.

Doesnt make any sense and I dont see it in the new Cisco Security Suite 3.0 either.

0 Karma

Splunk Employee
Splunk Employee

following up on unanswered questions... the TA has a different knowledge structure than the old app did, and has grown in different ways as newer Splunk versions have become available. The docs describing its current incarnation are here: If you have dashboards or alerts built on older names, you may be able to fieldalias those.

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!