Why would the source type cisco:ios not be getting created? Can I add it manually?

[QHGC]

complete Splunk noob
Just installed a fresh splunk-6.2.1-245427-x64-release on a Win2012 GUI box and installed:
Cisco Networks (cisco_ios) 2.1.1
Cisco Networks Add-on (TA-cisco_ios) 2.1.0

When I try to configure as per the instructions:
Syslog input: Enable a UDP input with a custom port number on your Splunk forwarder or Splunk indexer. Set the sourcetype to cisco:ios or syslog
I dont get the cisco:ios option as a source type; the only cisco item is cisco:asa

Any ideas why this would happen and how to resolve it?
Cheers

[mikaelbje · Accepted solution]

If you do this through the web interface of your Splunk Enterprise instance then choose custom sourcetype and then add the string cisco:ios in the input field. Leave source as it is, only modify the sourcetype.

[QHGC]

Thanks, I did do that but wasn't sure if it would work. Haven't been able to get any data from the switches yet and thought that might be a cause.
Thanks for the info guys 😉

[mikaelbje]

If you're still not getting any data, check if Splunk is actually listening on the port that you chose with "netstat -an | findstr PORTNUMBER" in the Windows command line.

The next step would be to check your Windows firewall, then any other firewalls in the network.

[Lucas_K]

I think he means in the inputs on your forwarder set the sourcetype to cisco:ios.

ie. in your inputs.conf on your uf.

[udp://somelisteningport]
disabled = 0
index = cisco
sourcetype = cisco:ios

[QHGC]

But I'm not using a forwarder, single server instance.