Data collection stops after initial API pull for Cisco Meraki Add-on for Splunk

[Chris_Urman]

I am experiencing an issue with the "Cisco Meraki Add-on for Splunk" where it connects to "api.meraki.com" grabs 5-10K events sometimes more or less then stops. The Heavy Forwarder is supposed to connect to the API five times a second but stops after only one connection. If I toggle the input off then on it will grab more data then stop again. 

I have confirmed we are not exceeding "max_content_length" and there are no errors in the internal logs. I have cases open with Splunk and Cisco. Diags are not showing anything obvious.

Has anyone else experienced this issue with the Cisco Meraki Add-On for Splunk?

[livehybrid]

Hi @Chris_Urman 

5 times a second seems *very* frequent. The API might be limited by the amount of events returned each time, I would suggest trying to set a longer frequency and see if subsequent API calls happen succesfully.

If its trying to load historic data then it might take a little bit of time to work through and get to the current time.

Could you also check the logs and let us know what its reporting around the time the input runs?

index="_internal" source=*splunk_ta_cisco_meraki*.log*

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[Chris_Urman]

Thank you for your insight. I turned the frequency down to one time per second and still the same behavior. I ran the query you provided and it returned info level events that the Splunk ingested data for the input.  No errors anywhere. 

" Events ingested in Splunk for input: cisco_meraki_airmarshal://airmarshal_SFG_Splunk, organization id: *************************, count=2264 | Total time taken: 7.438018 seconds

[shashankD]

Try to fetch API from the recent time like from last hour, or a day.

This API comes with the limitation and if the number of events are huge in numbers then the API will fail to pull the events. try to fetch the event from recent time rather then a large interval of old data.

[Chris_Urman]

Thank you for your insights. Right now the inputs are set to a 24 hour interval. I will adjust down to one hour.

[Chris_Urman]

After adjusting the input interval the behavior is still the same.