Hi, My events actually report CPU and Mem utilization... 35.45% and 25.56% I extract these over time but I don't get Lines on my chart. I'm wondering if these fields are read as text... so cant be graphed? My search is below CSCOacs_System_Statistics host="bob" | stats list(SysStatsUtilizationMemory) as MemUtil list(SysStatsUtilizationCpu) as CPU_Util by _time I'm wondering if I need to strip out the % from the results... or if I should be using a different tool... timechart or something. thanks ... View more

If Cisco IPS App is now deprecated, how should SDEE events be collected? thanks ... View more

I have a search defined to trigger an alert... eg search all failed logins and count by user_name If the number of failed logins > 5 in time_frame, then trigger alert. This works fine... I get an alert telling me that the Alert_ has triggered.... But this is not much information... The information content of the alert should at least contain the name of the user who failed to login 5 times. In general I'm asking for the ability to pass an extracted field from the search into the Alert forwarded to an up-stream system. Is this possible? Best regards Mathew ... View more

eg When I run a search over 7 days I get a bar chart with 7 bars (daily granularity) When I run a search over 24 hours I get a bar chart with 48 bars (30 min granularity) If I run a search over 7 days how can I make it give me (24x7) 168 bars? Is there something similar to Timerange picket for Granularity? thanks ... View more

Just reinstalled Splunk for Cisco Firewalls and restarted... Not seen this error before... Any suggestions? received event for unconfigured/disabled/deleted index='firewall' with source='source::DirectSysLogMessages' host='host::173.30.4.67' sourcetype='sourcetype::syslog' (1 missing total thanks ... View more

Disabling it does not remove menus from 'Splunk for Cisco Security' The splunk remove app command says app does not exist. [root@hostname apps]# ll total 92 drwx--x--x 8 root root 4096 Jul 15 17:14 amMap drwx------ 2 root root 4096 Aug 6 14:36 default drwxr-xr-x 2 root root 4096 Aug 6 16:15 ****** drwxr-xr-x 6 splunk splunk 4096 Jul 11 13:51 gettingstarted drwxr-xr-x 7 splunk splunk 4096 Jul 15 17:53 launcher drwxr-xr-x 5 splunk splunk 4096 Jul 11 13:53 learned drwxr-xr-x 3 splunk splunk 4096 Jul 11 13:51 legacy drwx--x--x 8 root root 4096 Aug 8 14:52 maps drwx------ 5 root root 4096 Jul 15 17:14 MAXMIND drwxr-xr-x 6 splunk splunk 4096 Jul 11 13:51 sample_app drwxr-xr-x 8 splunk splunk 4096 Jul 11 13:51 search drwx--x--x 9 root root 4096 Aug 6 14:37 sideview_utils drwx--x--x 8 root root 4096 Jul 16 15:30 Splunk_CiscoFirewalls drwx------ 9 root root 4096 Jul 15 17:12 Splunk_CiscoIPS drwx--x--x 7 root root 4096 Aug 14 17:42 Splunk_CiscoSecuritySuite drwxr-xr-x 4 splunk splunk 4096 Jul 11 13:51 splunk_datapreview drwx------ 7 root root 4096 Jul 15 18:04 splunk_deployment_monitor drwx--x--x 6 root root 4096 Jul 15 17:12 Splunk_for_CiscoASA drwxr-xr-x 4 splunk splunk 4096 Jul 11 13:51 SplunkForwarder drwxr-xr-x 4 splunk splunk 4096 Jul 11 13:51 SplunkLightForwarder drwx--x--x 6 root root 4096 Aug 8 14:51 TA-cisco_ios drwxr-xr-x 4 splunk splunk 4096 Jul 11 13:51 user-prefs drwx------ 9 root root 4096 Jul 15 18:04 windows [root@ams-coms-btnm-04 apps]# splunk remove app /opt/splunk/etc/apps/Splunk_CiscoFirewalls Application does not exist: /opt/splunk/etc/apps/Splunk_CiscoFirewalls [root@hostname apps]# ll Splunk_CiscoFirewalls total 72 drwx--x--x 3 root root 4096 Jul 15 17:13 appserver drwx--x--x 2 root root 4096 Jul 16 15:30 default drwx--x--x 2 root root 4096 Jul 15 17:13 default.old.20130716-153026 -r-------- 1 root root 19031 Jul 16 15:30 license-eula.rtf -r-------- 1 root root 18526 Jul 16 15:30 license-eula.txt drwx--x--x 2 root root 4096 Aug 8 14:46 local drwx--x--x 2 root root 4096 Jul 15 17:13 lookups drwx--x--x 2 root root 4096 Aug 8 14:46 metadata -r-------- 1 root root 5890 Jul 16 15:30 README.txt [root@hostname]# ... View more