The Splunk Add-on for Cisco IPS does connect and gather data, but why doesn't data show up in the Search app?

[antinym]

Addon v 2.1.4. Splunk v6.2.2 windows 2008 SP2.

Sdee connection is successful, I see good IPS data in the files in my D:\splunk\etc\apps\Splunk_TA_cisco-ips\var\log folder, but I can't see that data in the main search app.

I've done searches for keywords that show up in the log files, "eventtype=cisco_ips", IPs of the IPS's but the data doesn't show up.

[bwooden · Accepted solution]

Hi @antinym,

It sounds like that Splunk instance is not configured to monitor the output of that directory. Has Splunk been configured to monitor the output? There are steps in the Installation Manual for the IPS Add-On that can help you verify this from UI or CLI.

For windows, via the UI...

1. Navigate to Settings > Data inputs > Files & directories. Click Enable for the IPS monitor statement that matches your OS. For Windows that is $SPLUNK_HOME\etc\apps\Splunk_TA_cisco-ips\var\log\ips_sdee.log*

[antinym]

That was it.
I had enabled the *nix directory for monitoring not the Windows one.
Thanks a thousand.