All Apps and Add-ons

Splunk for Cisco IPS - exception thrown in sdee-get()

crob6281
Explorer

I'm setting up Splunk for Cisco IPS for the first time. It looks like it's able to connect, but seems to not be able to retrieve events.

sdee_get.log:

Fri Aug 19 12:00:41 2011 - INFO - Checking for exsisting SubscriptionID on host: x.x.x.x
Fri Aug 19 12:00:41 2011 - INFO - SubscriptionID: sub-3-adf9579a found for host: x.x.x.x
Fri Aug 19 12:00:41 2011 - INFO - Attempting to connect to sensor: x.x.x.x
Fri Aug 19 12:00:41 2011 - INFO - Successfully connected to: x.x.x.x
Fri Aug 19 12:00:41 2011 - ERROR - Exception thrown in sdee.get(): HTTPError: HTTP Error 400: Bad Request

The IDS model is ASA_SSM-10.

Suggestions?

Tags (1)
0 Karma

kenson
Explorer

Just stop the script and rm the *.run files in the apps var/run directory. Then start it again. The subscription id refers to some internal mechanism that supposedly helps the ips to remember which events you already fetched..

0 Karma

asrozar
New Member

how do you "delete your x.x.x.x.run file(s)"? What subscription ID is this referring too?

0 Karma

kenson
Explorer

This error happens when the subscription id for some reason is no longer valid on the device end. You need to delete your x.x.x.x.run file(s) and allow the script to attempt to open a new session without an existing subscription id.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...