All Apps and Add-ons

error while adding IPS sensor

axlbonn
New Member

Hi,

We have Enterprise support however issue with SplunkCiscoIPS 2.0 is not supported through Splunk support.. So I guess I be needing some splunk expert here which has an idea what is causing and resolving these error below:

Encountered the following error while trying to update: In handler 'localapps': Failed to search for existing Cisco IPS Sensor credential in app.conf!
and

Misconfigured view 'ips_dashboard' - Unknown parameter 'level' is defined for module Message. Make sure the parameter is specified in Message.conf.

Best regards,

Tags (1)
0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

You may want to re-run the setup screen. Goto Manager -> Apps, locate the Splunk for Cisco IPS, and then click the "setup" link. There is a username/password section you can fill out to have the credential error go away.

0 Karma

axlbonn
New Member

Thanks, but I tried setting it up several times..the same error all over again and I cannot even add a single sensor in the splunk.. when I tried to manually add input.conf and put the script for 2.0 below.

[script://$SPLUNK_HOME/etc/apps/Splunk_CiscoIPS/bin/get_ips_feed.py 172.21.21.10 1]
disabled = 0
index = main
interval = 1
source = SDEE
sourcetype = cisco_ips_syslog
passAuth = splunk-system-user

I'm getting "could not get IPS 172.21.21.10 credentials from splunk: ResourceNotFound: [HTTP 404]

Regards

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...