Monitoring Splunk

received event for unconfigured/disabled/deleted index='firewall' with source='source::udp:5447' host='host::x.x.x.x' sourcetype='sourcetype::cisco:asa' (1 missing total)

ionitsupport
New Member

Can't get this working with Splunk for Cisco ASA

Set ASA 5505 to forward syslog to usp/5447 with timestamps enabled

:/opt/splunk/etc/apps/Splunk_for_CiscoASA/local/inputs.conf show this:

[udp://5447]
connection_host = ip
sourcetype = syslog

Still get:
received event for unconfigured/disabled/deleted index='firewall' with source='source::udp:5447' host='host::x.x.x.x' sourcetype='sourcetype::cisco:asa' (1 missing total)

This is a vanilla install on Ubuntu 12.04, same issue on Windows 2012 so should not be OS specific.

I'd really appreciate if someone could bulletpoint steps taken for the benefit of all... thanks! 🙂

Did follow install notes:
Installation Notes

Pre-requisites;
- TA-cisco_asa (1.1)
- SideView Utils (used 1.3.5 not 2.x)
- Google Maps(1.1.2)

Tags (1)
0 Karma

pmcquaid
Engager

I also had this same issue. To fix it I had to do 2 things.

1.) Create an index named firewall
2.) Add this index to the "Indexes searched by default" section which is under Manager->Access Controls->Roles->Select the appropriate role.

This was done with v 5.0.4 of Splunk

I hope this is helpful.

yannK
Splunk Employee
Splunk Employee

the answer is in the title : received event for unconfigured/disabled/deleted index='firewall'
please create the index "firewall" in your indexer !

0 Karma

ionitsupport
New Member

Thanks, error message is gone. 😉

But I still don't get anything in Splunk for Cisco ASA app.
With all due respect I thought based on the Install notes I could get this working but I must be missing something.

Firewall index shows 311 events.

Could you please let me know the next step or point me to a guide?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!