Klaxdal's fix works. Why hasn't it been integrated into the stock TA yet? It's been almost a year! ... View more

Hello, I tried upgrading, and it seems to work. The only complaint recieved was that: The lookup table 'cisco_ips_vendor_info_lookup' does not exist. It is referenced by configuration 'cisco:ips:syslog'. I manually added to 'lookups' folder as described here http://docs.splunk.com/Documentation/AddOns/released/CiscoIPS/Lookups and the warning disappeared. Good luck with yours, Ilir ... View more