error while adding IPS sensor

New Member


We have Enterprise support however issue with SplunkCiscoIPS 2.0 is not supported through Splunk support.. So I guess I be needing some splunk expert here which has an idea what is causing and resolving these error below:

Encountered the following error while trying to update: In handler 'localapps': Failed to search for existing Cisco IPS Sensor credential in app.conf!

Misconfigured view 'ips_dashboard' - Unknown parameter 'level' is defined for module Message. Make sure the parameter is specified in Message.conf.

Best regards,

Tags (1)
0 Karma


You may want to re-run the setup screen. Goto Manager -> Apps, locate the Splunk for Cisco IPS, and then click the "setup" link. There is a username/password section you can fill out to have the credential error go away.

0 Karma

New Member

Thanks, but I tried setting it up several times..the same error all over again and I cannot even add a single sensor in the splunk.. when I tried to manually add input.conf and put the script for 2.0 below.

[script://$SPLUNK_HOME/etc/apps/Splunk_CiscoIPS/bin/ 1]
disabled = 0
index = main
interval = 1
source = SDEE
sourcetype = cisco_ips_syslog
passAuth = splunk-system-user

I'm getting "could not get IPS credentials from splunk: ResourceNotFound: [HTTP 404]


0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!