Cisco Security Suite visualization issue

Splunk Employee
Splunk Employee

Hello all,

I am collecting Cisco IronPort WSA events on Splunk 6.

The events got indexed at Splunk, and can be visualized via Search App.

However I am able not to visualize any data using from the Cisco Security Suite ( in conjunction with the Splunk_TA_cisco-wsa).

We have been trying different índex and sourcetype configurations but they don’t seem to be working.

Have you any of one of you have found similar problems in the past? Any standard índex and sourcetype specification recommended?



Tags (3)
0 Karma

Splunk Employee
Splunk Employee

Do you get results using the following search?


Also, did you copy the SA-cisco-wsa folder to $SPLUNK_HOME/etc/apps ?

0 Karma
Register for .conf21 Now! Go Vegas or Go Virtual!

How will you .conf21? You decide! Go in-person in Las Vegas, 10/18-10/21, or go online with .conf21 Virtual, 10/19-10/20.