Hey Mountain1, this maybe related to a known issue filed (SOLN-829). In the meantime, can you try the following? Modify file ../etc/apps/Splunk_CiscoIPS/local/inputs.conf Replace this line: [monitor://$SPLUNK_HOME/etc/apps/cisco_ips/var/log/] With this line: [monitor://$SPLUNK_HOME/etc/apps/Splunk_CiscoIPS/var/log/] If a local/inputs.conf doesn't yet exist create one and put the following in it: [monitor://$SPLUNK_HOME/etc/apps/Splunk_CiscoIPS/var/log/] sourcetype = cisco_ips_syslog disabled = false _whitelist = ips_sdee.log You may have to restart Splunk. Please let me know if you start picking up events. ... View more