v4.3.1 on sles 11.1
i have my cisco csa v5.2.0.278 alerts going to splunk via udp 162 (snmp traps)
the raw data (via splunk view) looks like this
0\x82\u0002\xC3\u0002\u0001\u0001\u0004\u0006public\xA7\x82\u0002\xB4\u0002\u0003\u001b3\xFA\u0002\u0001
and the Client Security App doesnt display anything. i set the source type to cisco_csa, so why this App not working?
the raw data from tcpdump for a snmp trap is:
16:56:05.188160 IP (tos 0x0, ttl 128, id 24807, offset 0, flags [none], proto UDP (17), length 762) venom.prod.org.cplscrambler-lg > SPLUNK.PROD.ORG.snmptrap: { SNMPv2c { V2Trap(715) R=1783164 system.sysUpTime.0=116503972 S:1.1.4.1.0=E:8590.3.1 E:8590.2.1=10317498 E:8590.2.2=1374 E:8590.2.3="HOSTB.prod.org" E:8590.2.4="2012-04-04 16:56:00.000" E:8590.2.5=2 E:8590.2.6=179 E:8590.2.7= E:8590.2.8= E:8590.2.9= E:8590.2.10= E:8590.2.11="The 'Service Control Manager' service logged event code 7036 into the system event log: The Ati HotKey Poller service entered the stopped state. " E:8590.2.12=1658 E:8590.2.13="10.132.194.174" E:8590.2.14="W" E:8590.2.15= E:8590.2.16= E:8590.2.17="NT Event log" E:8590.2.18="" E:8590.2.19=280 E:8590.2.20="CSA Service Monitoring" E:8590.2.21= E:8590.2.22= E:8590.2.23=0 } }
