Will the Technology Add-on for Cisco Secure Access Control Server (ACS) be updated for compatibility with Splunk 6.3?

[emartens]

Hi,

I like this add-on very much, but after the upgrade, it isn't compatible anymore with Splunk 6.3.
Is there a change that this APP is being upgraded?

Regards,
Ed Martens

[tross33]

Ed,

Thank you very much for posting this to the board. The ACS TA is critical to our environment, and you thankfully alerted me to this issue prior to implementing the 6.3 upgrade. Does anyone have any information on a workaround, or information on an App upgrade?

Regards,

Tyler Ross

[emartens]

Hi Tyler,

Data is correct in the search, however it not well formatted (eas of identify the different fields)

regards

[dshpritz]

Hello,

I'm not sure what you mean by this. I have installed the TA on 6.3 (not an upgrade) and the configurations are visible. Did this only happen after an upgrade? I'm sorry, I'm trying to reproduce the problem.

Thanks,

Dave

[emartens]

I receive a 500 Internal server error..
https://LINK:8000/en-US/app/TA-cisco_acs/search/

[emartens]

ps.
With 6.2 it was working after the upgrade it wasn't

[dshpritz]

Actually, that shouldn't work. This is an add-on, not an app. It is not meant to have a visual component. The extractions, eventtypes and tags are exported globally, so you should be able to use the fields in your other apps (like search or ES).

Thanks,

Dave

[trross33]

That is primarily my concern. We incorporate this data into ES, and have custom searches and alerts tied to field values, and ES tagged fields, so if the 6.3 update causes issues with the field extractions, this is my concern. Does anyone have any experience (positive or negative) with the upgrade to 6.3 (from 6.2.*) on a machine running the TA for ACS? Thanks everyone for the input, this is good information.

Tyler

[dshpritz]

Are you saying it isn't compatible because you tried it and something didn't work, or because the Splunkbase page doesn't list 6.3 as a supported version?

Thanks,

Dave

[emartens]

Hi Dave,

The plugin doesn't work in the 6.3 version.
Previously I was working with the 6.2 and the plugin was working great.
But in the 6.3 it has been disappeared. Also after re-installing it again it is not working.

Thanks for the response

[dshpritz]

That's really strange. I haven't tested it with 6.3, and I don't have a solution off the top of my head. I'll see what I can do about getting more info.