Getting Data In

Trying to pull data from IPS using SDEE

vhallan_splunk
Splunk Employee
Splunk Employee

How to pull data from Cisco IPS into Splunk. I tried using SDEE pool query but it did not work.

Any help on this would be great.

(for customer kiqbal @ Sega)

Tags (1)
0 Karma

jconger
Splunk Employee
Splunk Employee

You can use the app mentioned by alacercogiltatus. Take note that the app only works for Splunk version 5 and below. So, if you have Splunk 6, this app will not work out of the box. You can use a Splunk 5.x Heavy Forwarder to get information from your IPS and then forward to a Splunk 6 indexer. Or, this thread has a potential workaround for you as well to use IPS with Splunk 6 -> http://answers.splunk.com/answers/105193/cisco-ips-error-errno-8?page=1&focusedAnswerId=135759#13575...

0 Karma

alacercogitatus
SplunkTrust
SplunkTrust

It's old and outdated, but might work: http://apps.splunk.com/app/528/

alacercogitatus
SplunkTrust
SplunkTrust

If this answered your question, please accept it. Thanks!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...