I presume you have followed Splunk doc for setting up Cisco IPS as data source. http://docs.splunk.com/Documentation/AddOns/released/CiscoIPS/Configureinputs
If you still face any problem, please share inputs.conf, output of index=_internal tcpoutputproc error *.py
... View more