All Apps and Add-ons

User is unable to see the data in TA-Meraki App

  1. We got a requirement to install TA-Meraki app in splunk

  2. Downloaded the zip file from the link provided

copied the zip file to Splunk search Head server to the location /opt/splunk/etc/apps

  1. Unzipped the file

A folder with TA-Meraki has been created.

Changed the owner and group of the folder TA-Meraki to splunk:splunk recursively.

  1. Restarted Splunk.

/opt/splunk/bin/splunk restart

We could able to see the app TA-meraki in splunk web

  1. To send log data from Meraki to Splunk server, enable and add your syslog server

in Network-wide >> General >> Reporting >> Syslog servers.

This needs to be done by the Application team on Meraki device.

Application team confirmed that this has been done.

  1. We have created index Meraki and added the port 514 to Data inputs in Splunk.

User complained that the device is logging successfully into splunk but nothing is appearing in the app and the
source is still showing syslog rather than Meraki

What are the steps that we are missing.

Is inputs.conf file needs to be created? If yes, where we need to create the file. On splunk or on Meraki device.

Is sourcetype Meraki needs to be created?

If yes, can we follow the below method.

Go to the path /opt/splunk/etc/apps/TA-meraki/local on Splunk search head server

and create props.conf file (props.conf file does not exist) with the following stanza


Restart splunk.

0 Karma


Hi @pratapa

If you don't see inputs created you can create a inputs.conf in local directory.


host_segment = 4

sourcetype = meraki

sourcetype = meraki

TRANSFORMS-meraki_date_clipper = meraki_date_clipper

DEST_KEY = _raw
REGEX = (.*\s1\s)\d{8,10}\.\d{9}\s(.*)
FORMAT = $1$2


If this helps your like will be appreciated😊

0 Karma

Path Finder

Yes, you need to set the index and sourcetype to meraki so the inputs.conf should look like this (if you're still using udp 514):


In addition, make sure the TA-meraki app is also installed on your indexers. Once both of these changes are made you should see CIM-compliant data for Meraki on your Search Head.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...