All Apps and Add-ons

Splunk Cisco IPS Setup

promax
New Member

Hello, Just started using Splunk, i added two sensors through the web setup of Cisco IPS. I don't see any IPS data in splunk yet. For trouble shooting a did a search with:

index="_internal" sourcetype="sdee_connection" 

and get the error message:

ERROR - Connecting to sensor - 10.90.99.52: ExpatError: not well-formed (invalid token): line 5, column 192

I don't get the meaning of this error, can someone help?

Thanks,
Leon

0 Karma

dleung
Splunk Employee
Splunk Employee

Hi Leon, it looks like there might be some special characters in the IPS data that is not parsing correctly. We can further examine with sample XML export of the IPS data. Can you please contact Splunk support and we can go from there. Thanks, Danny.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...