error while adding IPS sensor

[axlbonn]

Hi,

We have Enterprise support however issue with SplunkCiscoIPS 2.0 is not supported through Splunk support.. So I guess I be needing some splunk expert here which has an idea what is causing and resolving these error below:

Encountered the following error while trying to update: In handler 'localapps': Failed to search for existing Cisco IPS Sensor credential in app.conf!
and

Misconfigured view 'ips_dashboard' - Unknown parameter 'level' is defined for module Message. Make sure the parameter is specified in Message.conf.

Best regards,

[alacercogitatus]

You may want to re-run the setup screen. Goto Manager -> Apps, locate the Splunk for Cisco IPS, and then click the "setup" link. There is a username/password section you can fill out to have the credential error go away.

[axlbonn]

Thanks, but I tried setting it up several times..the same error all over again and I cannot even add a single sensor in the splunk.. when I tried to manually add input.conf and put the script for 2.0 below.

[script://$SPLUNK_HOME/etc/apps/Splunk_CiscoIPS/bin/get_ips_feed.py 172.21.21.10 1]
disabled = 0
index = main
interval = 1
source = SDEE
sourcetype = cisco_ips_syslog
passAuth = splunk-system-user

I'm getting "could not get IPS 172.21.21.10 credentials from splunk: ResourceNotFound: [HTTP 404]

Regards