hi Arber, Seems like I focused on the results only, and checked only the dasboards. Strangely enough I have also similar errors (though they look a bit different, since you seem to have splunk installed in a Linux machine, and I have Windows server): ERROR - Exception thrown in sdee.get(): Traceback (most recent call last): File "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco-ips\bin\get_ips_feed.py", line 117, in run sdee.get() File "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco-ips\bin\pysdee\pySDEE.py", line 211, in get self._request(params, **kwargs) File "C:\Program Files\Splunk\etc\apps\Splunk_TA_cisco-ips\bin\pysdee\pySDEE.py", line 163, in _request data = urllib2.urlopen(req) File "C:\Program Files\Splunk\Python-2.7\Lib\urllib2.py", line 154, in urlopen return opener.open(url, data, timeout) File "C:\Program Files\Splunk\Python-2.7\Lib\urllib2.py", line 431, in open response = self._open(req, data) File "C:\Program Files\Splunk\Python-2.7\Lib\urllib2.py", line 449, in _open '_open', req) File "C:\Program Files\Splunk\Python-2.7\Lib\urllib2.py", line 409, in _call_chain result = func(*args) File "C:\Program Files\Splunk\Python-2.7\Lib\urllib2.py", line 1240, in https_open context=self._context) File "C:\Program Files\Splunk\Python-2.7\Lib\urllib2.py", line 1197, in do_open raise URLError(err) URLError: , However, when I check the dashboards and fetching of logs, the results are there (IPS analyst, overview, etc) they show relevant results as expected. Let's see if any advanced user/expert suggests us how to address these error messages and eventually solve your problem. I don't seem to have the answer. Ilir ... View more

Hello, I tried upgrading, and it seems to work. The only complaint recieved was that: The lookup table 'cisco_ips_vendor_info_lookup' does not exist. It is referenced by configuration 'cisco:ips:syslog'. I manually added to 'lookups' folder as described here http://docs.splunk.com/Documentation/AddOns/released/CiscoIPS/Lookups and the warning disappeared. Good luck with yours, Ilir ... View more

Hello, I tried upgrading, and it seems to work. The only complaint recieved was that: The lookup table 'cisco_ips_vendor_info_lookup' does not exist. It is referenced by configuration 'cisco:ips:syslog'. I manually added to 'lookups' folder as described here http://docs.splunk.com/Documentation/AddOns/released/CiscoIPS/Lookups and the warning disappeared. Good luck with yours, Ilir ... View more

Hello, http://docs.splunk.com/Documentation/AddOns/latest/CiscoIPS/Releasenotes https://splunkbase.splunk.com/app/1903/ Just got a notification that Cisco IPS app version 2.1.5 is out which claims to fix this ADDON-6014. Haven't tried it yet though. Let me know if you do. I will let you know if I test it. Cheers, Ilir ... View more

http://docs.splunk.com/Documentation/AddOns/latest/CiscoIPS/Releasenotes Cisco IPS app version 2.1.5 is out which claims to fix this. Haven't tried it yet though. ... View more

Hi, Which version of Cisco Security Suite have you installed? I have configured Cisco Security Suite 3.1.1 on Splunk 6.3.1 and it seems OK in most of it, apart from cisco IPS app which is not functioning, and there is a case opened in Splunk for that (ADDON-6014) and some warning signs: Eventtype 'cisco_esa_authentication' does not exist or is disabled. Eventtype 'cisco_esa_email' does not exist or is disabled. Eventtype 'cisco_esa_proxy' does not exist or is disabled. for the above I simply disabled the Eventtype cisco-esa and the warning signs were gone. Maybe a simple thing worth trying, try the installation using different Internet Browsers? I've sometimes had issues with IE, and now tend to use Firefox to configure stuff over the web. Cheers, I ... View more

Hi Kevin, Seems like I need the first fix before I try the second. How can one obtain the app provided by Splunk Support? Can you share it somehow? Thanks, Ilir ... View more

This solved the problem in my case. Seems like by just using UI it does not sometimes write the conf file as it should. Hence, I modified the database.conf file manually, and restarted splunk. Now it is all OK. (btw using dbx 1.1.7 here) ... View more

Just an update, I followed some links suggesting to disable "Cisco ASA / PIX / FWSM Dashboards" i.e. SA-cisco-asa , as well as I updated the Splunk Add-on for Cisco ASA to version 3.2.3 now it is OK, no more errors and all the dashboards are populated properly. ... View more

I managed to configure mine, however, I don't have a distributed search environment. Extending the session timeout in web.conf finally got me to the screen to enable the apps I needed, and all looks fine now. Just checked that I also lack some dashboards, and receive the messages: The lookup table 'networkservice' does not exist. It is referenced by configuration 'cisco:asa'. The lookup table 'networkservice' does not exist. It is referenced by configuration 'cisco:fwsm'. The lookup table 'networkservice' does not exist. It is referenced by configuration 'cisco:pix' ... View more

hi, Modifying the bin/pysdee/pySDEE.py and changing the SSLv3 version to TLSv1 helped solve my problem, as was explained here http://answers.splunk.com/answers/105193/cisco-ips-error-errno-8.html and here: http://blog.hortonew.com/splunk-ciscoips-app-no-longer-pulls-from-ips Hope it helps you, too I. ... View more

Hi, I had the same problem after upgrading to 2.0.1. Completely reinstalling the SA-ldapsearch app (again ver 2.0.1), and creating two profiles inside ldap.conf (default and ours) with the same details configured - solved it in my case. ... View more

I followed the instructions here https://yaleman.org/2013/12/13/splunk-web-interface-ssl-certificates-microsoft-ad-ca/ and it worked like charm. ... View more