I had a service account that was failing authentication. We fixed the account OU and it still did not authenticate. Refreshing authentication configuration helped in refreshing the cache. Thank you very much! ... View more

Hi Stanley, The statement was incorrect. I meant, install the add-on on the heavy forwarders OR the indexers(search peers). If you have installed the add-on on heavy forwarders, I recommend to have the add-on on the indexers as well, just for having all the right .conf files for the incoming data. You don't need to setup the add-on on the indexer, just setup the add-on on the the heavy forwarder. If you install the add-on on all the heavy forwarders, it will have duplicate data. Also in case of a failure, you need to again setup the app on another heavy forwarder in such scenario. One way to minimize the impact is if you have multiple ACI fabrics having their own APIC clusters, You can individually setup each APIC of an ACI fabric on an individual heavy forwarder. Hope this helps! ... View more

The password is stored in local/passwords.conf directory of the app. The collector script collect.py takes this password information and uses it for authentication. Two ways I can think of how you can integrate CyberArk is: 1. a. To create an automated script polled on regular interval to look into the vault and updates the passwords.conf file OR b. Make CyberArk update passwords.conf in the Splunk app if the APIC password is updated in the vault. 2.Modify the collect.py script to use APIs to get password information instead of looking into passwords.conf ... View more

Yes, the Cisco ACI app works in a Splunk distributed environment. You would want to install the add-on on the search peers of the heavy forwarders or the search peers to collect and index the APIC data. Install the Cisco ACI App on the Search Heads and allow it to search the index where the data lies. One manual configuration file eventtypes.conf needs to be included in the Apps local/default directory on Search Heads. The file can be found in the Add-on under $SPLUNK_HOME/etc/apps/TA_cisco-ACI/default/. You can push them through the deployer or manually paste the file on each of them Once you have the above steps, try a search from SH ' index = sourcetype = cisco:apic:* | stats count by sourcetype'. By default the index the data exists is 'main'. ... View more

Thank you. I noticed some VMs did not have VMware tools and some did. I also enabled worker processes on the forwarder where the DCN is configured. ... View more