×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
ww9rivers26
Loves-to-Learn
Member since: ‎02-24-2026
‎03-27-2026
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎02-24-2026
View All

Re: CiscoSecurityCloud app not parsing fields for ...

by in All Apps and Add-ons
‎03-27-2026 06:46 AM
‎03-27-2026 06:46 AM
That ww9rivers was my old account here -- I lost that and does not know how to get it back. The short answer is no, Splunk does not support this add-on. Cisco has published multiple new versions after I initially posted my question here. However, the latest version (3.6.3) still get this wrong. Below is my fix (tested in production): $ git diff v3.6.3 diff --git a/default/transforms.conf b/default/transforms.conf index f1f89d8..93334a2 100644 --- a/default/transforms.conf +++ b/default/transforms.conf @@ -192,7 +192,7 @@ REGEX = "user_agent":\s*"([^"]+)" FORMAT = syslog_user_agent::$1 [cisco_asa_log_level_message_id] -REGEX = %(?:ASA|FTD|FMC)(?:-[A-Za-z]+)?-(?P<log_level>\d+)-(?P<message_id>\d+) +REGEX = %(?:ASA|FTD|FMC)-(?:.*?-)?(?P<log_level>\d)-(?P<message_id>\d+) Edit: Had to fix the REGEX again to cover more different formats found. ... View more

Re: Splunk DB Connect "The Task Server is currentl...

by in Splunk Enterprise
‎02-26-2026 01:41 PM
‎02-26-2026 01:41 PM
Thank you for the response. I think you mean `$SPLUNK_HOME/etc/auth/server.pem`. However, we are using a third-party CA signed cert for the server's web UI. So I cannot let Splunk creating a self-signed cert. In our installations, these files are replaced with appropriate certs and key: etc/auth/cacert.pem etc/auth/server.pem etc/auth/splunkweb/cert.pem etc/auth/splunkweb/privkey.pem   ... View more

Splunk DB Connect "The Task Server is currently un...

by in Splunk Enterprise
‎02-24-2026 09:41 PM
‎02-24-2026 09:41 PM
Just did a fresh install of Splunk Enterprise 10.0.3, set up HTTPS with the web service, then installed Splunk DB Connect 4.21. The host runs RHEL 9.7. Java is openjdk 11.0.25 2024-10-15 LTS. Set up and started Splunkd service. Logged in. The Splunk DB Connect app shows a message: The Task Server is currently unavailable. Please check your settings. I have had issues with the "task server" and I have been able to resolve them with proper Java settings. But not this time. I tried to manually run the task server. The bin/server.sh script simply hangs. While that happens, I can find the java process that runs the server.jar but no port 9998 open. Also, in the splunkd.log, this error shows up every few seconds: failed to run task server, error=com.splunk.dbx.exception.HttpConnectionException: An error occurred while processing the HTTP request. So it seems that it is possibly a problem between the task server with the Splnkd service itself? May be on the management port 8089? ... View more
Labels
Contact Me
Online Status
Offline
Date Last Visited
‎03-27-2026 06:34 AM