Hello Team, I have installed Cisco WSA add on, receiving W3C syslogs from my WSA. Trying to configure this app in Splunk as per: http://docs.splunk.com/Documentation/AddOns/released/CiscoWSA/Configureinputsonforwarder And documentation is not clear, what is "\filename" ? Could you please help me ? I do also not understand where do i bind syslogs received from WSA to specific index/sourcetype/filename ? How my splunk instance would know that specific syslog message has been received from WSA and should be processed by WSA application/dashboard ? Thanks, ... View more

Hello Team, I have installed: Splunk Add-on for Cisco Identity Services Splunk for Cisco Identity Services (ISE) I do received all syslogs from my ISE server, can see it with search host=1.2.3.4, but i do not have sourcetype: sourcetype=cisco:ise:syslog My syslogs from ISE are of generic sourcetype=udp:514 (i have a lot of hosts sending udp/514 syslogs to splunk) As a result my application/dashboard does not show any logs, i guess it's configured to search for "sourcetype=cisco:ise:syslog". Question: Should not the application ask me to configure that ? How to fix it, without breaking what i do have currently ? Do i need to create manually that sourcetype ? When going to sourcetypes i do not see it (the only sourcetype with string "cisco" is for asa), but when trying to create "cisco:ise:syslog" i do receive error that source type already exists. Why ? One more: i have clicked "Set up" for "Splunk Add-on for Cisco Identity Services" - but all the settings on that page are for remediation and pxgrid protocol - i do not need that. Just clicked save. I hope that i am not forced to konfigure pxgrid to have a basic ISE dashboard working ? I have also checked i can see multiple event types which are related to ISE, but i do see only one search related to ISE: "Lookup - Locations" - i guess it's not enough - is not it ? Why ? Thanks, ... View more

Hello Team, I have a search which is returning statistics (not events). I would like to generate alert and call custome bash script only in case where i have at least 1 statistic result like this: While i do not want to call external script when having 0 statistic results like this: Please keep in mind that for both we do have 1 event found - and that is irrelevant. I have read: http://docs.splunk.com/Documentation/Splunk/6.4.3/Alert/Configuringalertsinsavedsearches.conf And can see: "Alerts use a saved search to look for events". But in my case i am not interested in events but statistics. Possible ? How to launch external script easily in case i have a match and statistic data is produced ? Thanks, Michal ... View more

Hello Team, map command is working for me but only with some fields. For example: host="10.62.140.64" CISE_Profiler EndpointMatchedPolicy=Workstation EndPointMACAddress | stats count by host | map search="search host=$host$" is working fine (i know it does not have much sense) But for: host="10.62.140.64" CISE_Profiler EndpointMatchedPolicy=Workstation EndPointMACAddress | stats count by EndPointMACAddress | map search="EndPointMACAddress=$EndPointMACAddress$" I got error: Error in 'map': Did not find value for required attribute 'EndPointMACAddress'. Why ? What is the difference in host and EndPointMACAddress ? My raw event: Aug 25 09:13:28 10.62.140.64 Aug 25 08:28:54 ise2-0-1 CISE_Profiler 0000000238 4 0 2016-08-25 08:28:54.231 +02:00 0000625546 80002 INFO Profiler: Profiler EndPoint profiling event occurred, ConfigVersionId=114, EndpointCertainityMetric=10, EndpointIPAddress=10.62.140.218, EndpointMacAddress=00:50:B6:11:EA:CE, EndpointMatchedPolicy=Workstation, EndpointNADAddress=10.62.140.16, EndpointOUI=GOOD WAY IND. CO.\, LTD., EndpointPolicy=Workstation, EndpointProperty=PolicyVersion=1\,49154-tcp=unknown\,AuthenticationIdentityStore=Internal Users\,EndPointPolicyID=7022f170-6d8e-11e5-978e-005056bf2f0a\,operating-system=Microsoft Windows Server 2008 SP1 (accuracy 96%)\,AuthenticationMethod=MSCHAPV2\,FirstCollection=1472106500025\,49155-tcp=unknown\,DestinationPort=1812\,CacheUpdateTime=1472106534199\,49153-tcp=unknown\,StaticAssignment=false\,User-Name=soc\,NmapScanCount=1\,SelectedAccessService=Default Network Access\,PostureExpiry=\,NetworkDeviceName=lab2-3850-1\,49156-tcp=unknown\,NAS-Port=50101\,DestinationIPAddress=10.62.140.64\, Thanks, Michal ... View more