All Apps and Add-ons

Cisco Networks App for Splunk Enterprise - Tenant Support?

deckemha
Explorer

Hello all,

we use the following Cisco Apps, which are working fine in general.

Cisco Networks App for Splunk Enterprise (https://splunkbase.splunk.com/app/1352)

Cisco Networks Add-on for Splunk Enterprise(https://splunkbase.splunk.com/app/1467)

 

When I edit the dashboard of the Cisco Networks App, I can find the following macro which should lead to the possiblity to select a "tenant".

Macro:

`get_tenants_for_user_role($env:user$)`

Expanded it looks like this:

 

 

inputlookup cisco_ios_tenants
| stats values(index) AS index BY tenant_name,roles
| eval index=mvjoin(index,",")
| eval index=replace(index,","," OR index=")
| eval index="index=" + index
| search [| rest splunk_server=local /services/authentication/users/$user$
| fields roles]

 

 

Unfortunatelly there is no lookup (definition) named cisco_ios_tenants, not in the App nor the Addon.

I also found in the default.xml nav that there should be a " <view name="cisco_networks_tenants" />"

This does also not exist.

 

I'm wondering on how that tentant support works and how it could be configured.

Does anymore has information about this? I was not able to find something.

 

Basically what we want to achieve (maybe there is a better way of doing it):

Our network colleagues want to have the possiblity to select the data based on something like a location/region or something. As the tentant macro is implemented nearly on all dashboards, I think that could be something to solve the problem.

Thanks in advance!

Many Regards

Michael

Labels (2)
Tags (3)
0 Karma

gcusello
Esteemed Legend

Hi @deckemha,

I don't know this app, but usually there's a generating Lookup scheduled search to enable.

Check it in the alerts one of these apps.

Ciao.

Giuseppe

deckemha
Explorer

Dear Giuseppe,

thanks for your reply.

That is something I've checked already. Unfortunatelly there are no saved searches / alerts in those apps doing things like creating a lookup, etc.

Many Regards

Michael

0 Karma

gcusello
Esteemed Legend

Hi @deckemha,

when I need to monitor Cisco network appliances I usually use the Cisco Security Suite (https://splunkbase.splunk.com/app/5743), you could see if the features you're searching are also in this app.

Ciao.

Giuseppe

deckemha
Explorer

Hello,

thanks for the hint.

For now we'll use the inital app without tenant support.

The requestor need some time to specifiy their exact requirements.

Thanks and many Regards

Michael

0 Karma

gcusello
Esteemed Legend

Hi @deckemha,

if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Spotlight on Security: Adoption Motions, War Stories, and More

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Cloud | Empowering Splunk Administrators with Admin Config Service (ACS)

Greetings, Splunk Cloud Admins and Splunk enthusiasts! The Admin Configuration Service (ACS) team is excited ...

Tech Talk | One Log to Rule Them All

One log to rule them all: how you can centralize your troubleshooting with Splunk logs We know how important ...