About jgaccornero

jgaccornero · ‎01-30-2020

Ok, final update. The bottom line was the settings in the eventtypes.conf file needed to be manually added to our Splunk Cloud search head. after that is done...it works fine. So if you are running a distributed Splunk configuration...make sure you either copy over the eventtypes.conf from the add-ons ./default directory or manually add them (there were only 5 eventtypes ACI add-on)

jgaccornero · ‎01-30-2020

Another update: I think the data is all there, but the Cisco APP is checking the following in order to populate the dropdown list of APIC Hosts: eventtype="cisco_apic_*" component=credentials | fields apic_host | dedup apic_host | SORT apic_host However there is no eventtype with "cisco*". There is a sourcetype="cisco:apic:*" In fact, if i change the search on the dropdown as follows Change: eventtype="cisco_apic_" To: sourcetype="cisco:apic:" it works fine. I wonder if there is a conflict with the version of the Cisco ACI APP running on our search head, and the Cisco ACI Add-on running on the forwarder?

jgaccornero · ‎01-30-2020

Ok, i do see data coming in from the forwarder. it is being added to the main index. I'm assuming that I also need to add the "apic" index on the forwarder as well ?

jgaccornero · ‎01-30-2020

I added the index 'apic' to Splunk Cloud. I've been checking for data found in the 'apic' index but nothing so far. I verified the forwarder is up and running. Is there anything I can check on the forwarder to see if it's even attempting to forward the ACI data to the Cloud? I know that it is forwarding other data to the cloud with no issues. I'll keep digging...

jgaccornero · ‎01-27-2020

Thats probably the issue. The app had been installed on Splunk cloud a while ago by someone else and I don't see an index named 'apic'. I will add it and test. I'll reply with the results. Thanks! Jon

jgaccornero · ‎01-27-2020

Running Splunk Cloud v 7.0.13. Cisco ACI App installed on Splunk Cloud V 4.0.1 I installed the Cisco ACI Add on to an existing heavy fowarder (which is already forwarding data to our cloud instance) and , based on the splund.log, it looks like it is communicating with the ACI devices just fine. I do not see any cisco data hitting our cloud instance. I've been looking through the Splunk FAQs for some tips on where to look to troubleshoot this. I have verified the following: 1. Cisco ACI add on scripts are all enabled on the forwarder 2. splunkd. log (on the forwarder) indicates it is connecting and communicating with the Cisco device. Looking for suggestions on how to troubleshoot this. Thanks! Jon

jgaccornero · ‎01-22-2020

Awesome, thank you!!

jgaccornero · ‎01-22-2020

We have Splunk Cloud with the Cisco ACI App installed. Trying to setup the Cisco ACI Add-on on a local Heavy Forwarder but the search for the add on doesn't show this. It shows a couple Cisco add on's, but none of them show the ACI add-on. Perhaps I need to manually download it and import it?

jgaccornero · ‎12-19-2019

Ok, thank you! I will go ahead and update them. Thanks again! Jon

jgaccornero · ‎12-19-2019

We use Splunk Cloud and have 3 Heavy Forwarders (which I updated yesterday with the new datetime.xml). We also have about 10 universal fowarders (most of them on Windows). Do I need to apply the datetime.xml to those as well? thanks!

Posts	10
Solutions	1
Karma Given	0
Karma Received	0
Member Since	‎12-19-2019

Online Status	Offline
Date Last Visited	‎06-05-2020 02:03 AM

Cisco ACI App with Splunk Clould

Cannot find Cisco ACI Add-on for Splunk Enterprise

Splunk datetime issue - does this affect Universal...

Re: Cisco ACI App with Splunk Clould

Re: Cisco ACI App with Splunk Clould

Re: Cisco ACI App with Splunk Clould

Re: Cisco ACI App with Splunk Clould

Re: Cisco ACI App with Splunk Clould

Cisco ACI App with Splunk Clould

Re: Cannot find Cisco ACI Add-on for Splunk Enterp...

Cannot find Cisco ACI Add-on for Splunk Enterprise

Re: Splunk datetime issue - does this affect Unive...

Splunk datetime issue - does this affect Universal...