About skurasak1

skurasak1 · ‎07-28-2025

Did you ever get an anwer for this, I'm having the same problem, my universal forwarder sends it to my indexer to specific index, but the TA_cisco_ios doesn't seem to do transform to correct the hostname for me. I'm not clear on what specific change on TA props.conf or transform.conf to read the specific index.

skurasak1 · ‎07-15-2025

Thanks, I did have the FQDN, so the search is still on, hopefully others had the similar issue and resolution. Any ideas on which log would show why, I'm not able to find one that would give me a hint.

skurasak1 · ‎07-09-2025

I believe I have things setup similarly but after I get CAC PIN pop up, It just goes to the standard login page. I can login with my ldap setup and can login with PIV@mil at the login prompt, but shouldn't thing bypass the login once the CAC/PIN is successful? What am I missing?

skurasak1 · ‎04-23-2025

Having the same problem had to go back to the <p></p> method that was previously in the interim.

skurasak1 · ‎03-20-2025

Just opened a ticket with support they said you can remove the file without problems and I have verified it, it was placed there as future versions are going to use it with patched version and will likely be removed with future versions of 9.14.x until that time. I personally don't like that they are using it, since postgres gets updated all the time and thus having this dependency on your product.

Posts	5
Solutions	1
Karma Given	1
Karma Received	8
Member Since	‎12-09-2019

Online Status	Offline
Date Last Visited	‎07-28-2025 05:21 PM

Re: How do you set Cisco Add-on to a specific inde...

Re: Splunk CAC Based Authentication

Re: Splunk CAC Based Authentication

Re: About the login banner in Web.conf

Re: Postgresql on Splunk Enterprise

Are you a member of the Splunk Community?

Re: How do you set Cisco Add-on to a specific inde...

Re: Splunk CAC Based Authentication

Re: Splunk CAC Based Authentication

Re: About the login banner in Web.conf

Re: Postgresql on Splunk Enterprise