received event for unconfigured/disabled/deleted index='firewall' with source='source::udp:5447' host='host::x.x.x.x' sourcetype='sourcetype::cisco:asa' (1 missing total)

[ionitsupport]

Can't get this working with Splunk for Cisco ASA

Set ASA 5505 to forward syslog to usp/5447 with timestamps enabled

:/opt/splunk/etc/apps/Splunk_for_CiscoASA/local/inputs.conf show this:

[udp://5447]
connection_host = ip
sourcetype = syslog

Still get:
received event for unconfigured/disabled/deleted index='firewall' with source='source::udp:5447' host='host::x.x.x.x' sourcetype='sourcetype::cisco:asa' (1 missing total)

This is a vanilla install on Ubuntu 12.04, same issue on Windows 2012 so should not be OS specific.

I'd really appreciate if someone could bulletpoint steps taken for the benefit of all... thanks! 🙂

Did follow install notes:
Installation Notes

Pre-requisites;
- TA-cisco_asa (1.1)
- SideView Utils (used 1.3.5 not 2.x)
- Google Maps(1.1.2)

[pmcquaid]

I also had this same issue. To fix it I had to do 2 things.

1.) Create an index named firewall
2.) Add this index to the "Indexes searched by default" section which is under Manager->Access Controls->Roles->Select the appropriate role.

This was done with v 5.0.4 of Splunk

I hope this is helpful.

[yannK]

the answer is in the title : received event for unconfigured/disabled/deleted index='firewall'
please create the index "firewall" in your indexer !

[ionitsupport]

Thanks, error message is gone. 😉

But I still don't get anything in Splunk for Cisco ASA app.
With all due respect I thought based on the Install notes I could get this working but I must be missing something.

Firewall index shows 311 events.

Could you please let me know the next step or point me to a guide?