Getting Data In

How do I install the Cisco MARS Archive add-on?

Will_Hayes
Splunk Employee
Splunk Employee

How do I install and configure the Cisco MARS archive add-on on Splunkbase?

Tags (2)
0 Karma

Will_Hayes
Splunk Employee
Splunk Employee
0 Karma

williamche
Path Finder

Will,

I can't find any reference to a Cisco MARS Archive add-on in Splunkbase. Where I can I get this app?

0 Karma

Will_Hayes
Splunk Employee
Splunk Employee

To install this add-on, unpack this file into $SPLUNK_HOME/etc/apps and restart.

http://www.splunkbase.com/apps/All/4.x/Add-On/app:Cisco+MARS+Archive+Add-on

Configure your MARS instance schedule an export of the raw message archive logs into a directory accessible by the Splunk Server.

Once the data is in a directory accessible by the Splunk server, you will need to configure a data input to monitor that directory instructions on how to configure a data input can be found here: http://www.splunk.com/base/Documentation/latest/Admin/WhatSplunkCanMonitor

When configuring the data input you will need to select manual and set cisco_mars_rm.

There is one scheduled search included in this add-on which creates an cache for the dashboard every 3 hours with a Splunk enterprise license. To change the schedule you can edit the following search under the manager:

Cisco MARS Archive - IPS - DataCube

Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...