Check your local.meta file at the following path: /opt/splunk/etc/apps/Splunk_TA_cisco-asa/metadata and look for this stanza [lookups] access = read : [ power, sc_admin ], write : [ ess_analyst, power, sc_admin ] export = system version = 9.1.2308.201 modtime = 1710775209.916764000 then add the role to the access like so: access = read : [ user ,power, sc_admin ] If this answer helped, let me know.  ... View more

i have a similar problem and couldnt figure out how to get rid of LOCALHOST 8000 error, which refuses my connection  ... View more

you should use SETLOCAL ENABLEDELAYEDEXPANSION instead of SETLOCAL and change your code to  this: ECHO OFF SETLOCAL ENABLEDELAYEDEXPANSION FOR /F "delims=" %%i IN ('wmic service SplunkForwarder get Pathname ^| FINDSTR /m service') DO SET SPLUNKDPATH=%%i SET SPLUNKPATH=%SPLUNKDPATH:~1,-28% >> %WINDIR%\sysmon.log ( ECHO %DATE%-%TIME% The SplunkUniversalForwarder is installed at %SPLUNKPATH% ECHO %DATE%-%TIME% Checking for Sysmon FOR /F "delims=" %%c IN ('sc query "Sysmon" ^| FIND /c "RUNNING"') DO ( SET CHECK_SYSMON_RUNNIG=%%c ) IF EXIST %WINDIR%\sysmon.exe ( FOR /F "delims=" %%b IN ('c:\windows\sysmon.exe ^| FIND /c "System Monitor v11.11"') DO ( SET CHECK_SYSMON_VERSION=%%b ) ) ECHO CHECK_SYSMON_VERSION=!CHECK_SYSMON_VERSION! ECHO CHECK_SYSMON_RUNNIG=!CHECK_SYSMON_RUNNIG! if "!CHECK_SYSMON_RUNNIG!" == "1" ( ECHO %DATE%-%TIME% Sysmon found, checking version IF "!CHECK_SYSMON_VERSION!" == "1" ( ECHO %DATE%-%TIME% Sysmon already up to date, exiting ENDLOCAL EXIT ) ELSE ( ECHO %DATE%-%TIME% Sysmon binary is outdated, un-installing IF EXIST %WINDIR%\sysmon.exe ( %WINDIR%\sysmon.exe -u ) ) ) ELSE ( ECHO %DATE%-%TIME% Sysmon not found, proceding to install ECHO %DATE%-%TIME% Copying the latest config file COPY /z /y "%SPLUNKPATH%\etc\apps\TA-Sysmon-deploy\bin\config.xml" "C:\windows\" ECHO %DATE%-%TIME% Installing Sysmon "%SPLUNKPATH%\etc\apps\TA-Sysmon-deploy\bin\sysmon.exe" /accepteula -i c:\windows\config.xml | Find /c "Sysmon installed" 1>NUL ECHO %DATE%-%TIME% Install complete! ENDLOCAL EXIT ) ECHO %DATE%-%TIME% Install failed ) ENDLOCAL ... View more

succeeded with: index=ise ("authentication failed" "Administrator-Login") OR ("authentication failed" "UserName") | stats count by UserName | append [search index=ise ("authentication failed" "Administrator-Login") OR ("authentication failed" "UserName") | stats count by AdminName] ... View more

@vmocovic2, You are probably better off asking a new question, since this question was closed and answered 4 years ago. (Also - I'd look at your various lookup permissions , but if you post this with some supporting information as a new question I'm sure you'll get a LOT more detail to help you solve your problem faster and better!) ... View more