Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Join the Conversation
Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About taasai
taasai
New Member
Member since:
11-26-2017
03-12-2025
Community Statistics
| Posts | 4 |
| Solutions | 0 |
| Karma Given | 0 |
| Karma Received | 0 |
| Member Since | 11-26-2017 |
Activity Feed
- Posted Migration from Duo Splunk Connector question on All Apps and Add-ons. 03-11-2025 09:04 PM
- Posted How can I retrieve the event log that was stored on Firepower while the FMC was down? on All Apps and Add-ons. 11-29-2017 07:31 PM
- Tagged How can I retrieve the event log that was stored on Firepower while the FMC was down? on All Apps and Add-ons. 11-29-2017 07:31 PM
- Tagged How can I retrieve the event log that was stored on Firepower while the FMC was down? on All Apps and Add-ons. 11-29-2017 07:31 PM
- Posted Re: Cisco AMP for Endpoints Events Input: Saving a new Input returns status 404 on All Apps and Add-ons. 11-27-2017 06:29 AM
- Posted Cisco AMP for Endpoints Events Input: Saving a new Input returns status 404 on All Apps and Add-ons. 11-26-2017 09:52 PM
- Tagged Cisco AMP for Endpoints Events Input: Saving a new Input returns status 404 on All Apps and Add-ons. 11-26-2017 09:52 PM
- Tagged Cisco AMP for Endpoints Events Input: Saving a new Input returns status 404 on All Apps and Add-ons. 11-26-2017 09:52 PM
- Tagged Cisco AMP for Endpoints Events Input: Saving a new Input returns status 404 on All Apps and Add-ons. 11-26-2017 09:52 PM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 | |||
| 0 |
03-11-2025
09:04 PM
We are referring to the following site for the setup: Cisco Security Cloud App for Splunk User Guide - Configure Cisco Products in Cisco Security Cloud App [Support] - Cisco https://www.cisco.com/c/en/us/td/docs/security/cisco-secure-cloud-app/user-guide/cisco-security-cloud-user-guide/m_configure_cisco_products_in_cisco_security_cloud.html In the "Configure an Application" chapter and the "Cisco Duo > Procedure" section, does the "Input Name" refer to the value set in the Duo Admin Console under "Admin API > Settings > Name"? Do these values need to be consistent between Splunk and Duo? I understand that the configuration settings in Cisco Security Cloud can be reused from the Duo Splunk Connector. Is this correct? Or are there any configuration items that have changed from the Duo Splunk Connector? Currently, we are setting permissions according to step 4 of the "First Steps" on the following site: https://duo.com/docs/splunkapp#first-steps . Should we apply the same settings when implementing Cisco Security Cloud? Are the server system requirements for implementing Cisco Security Cloud the same as those for the Duo Splunk Connector? If there are differences, could you please provide detailed system requirements?
... View more
Labels
- Labels:
-
configuration
11-29-2017
07:31 PM
Hi,
I'm testing the eNcore's behavior in some FMC failure scenarios. Even if the FMC encounters a shutdown, the FMC retrieves the event logs that was stored on the Firepower during the failure when it comes online again, and the log will be shown on the FMC's GUI. But eNcore dashboard didn't show the log. It just missed. Is there any way to have eNcore retrieve the log from FMC on demand?
... View more
11-27-2017
06:29 AM
do you mean this file?
"source = /opt/splunk/var/log/splunk/splunkd.log"
I got no entry for the file when I save. But I got the following
2017-11-27 23:12:23,566 ERROR Amp4eEvents - API Error (status 400): {"version":"v1.2.0","metadata":{"links":{"self":"https://api.apjc.amp.cisco.com/v1/event_streams"}},"data":{},"errors":[{"error_code":400,"description":"Bad Request","details":["the server responded with status 404"]}]}
host = localhost.localdomain source = /opt/splunk/var/log/splunk/amp4e_events_input.log sourcetype = amp4e_events_input-2
2017-11-27 23:12:23,566 INFO Amp4eEvents - Received response from ApiService (400)
host = localhost.localdomain source = /opt/splunk/var/log/splunk/amp4e_events_input.log sourcetype = amp4e_events_input-2
2017-11-27 23:12:22,672 INFO Amp4eEvents - ApiService - creating stream with params {'group_guid': [], 'name': u'host', 'event_type': [u'1090519054']}
host = localhost.localdomain source = /opt/splunk/var/log/splunk/amp4e_events_input.log sourcetype = amp4e_events_input-2
... View more
11-26-2017
09:52 PM
Hi,
WHen I am trying to save a new Input, the following response is coming back.
"Input could not be saved:
the server responded with status 404"
I just copied and pasted the API I and the API Key that were shown on the AMP Console GUID, host name is "api.apjc.amp.cisco.com" as long as I use the APJC AMP tower. I checked the following document.
https://api-docs.amp.cisco.com/
Does anyone know how to configure and save the info?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
03-12-2025
01:20 AM
|
