Cisco Networks App for Splunk Enterprise - Tenant Support?

[deckemha]

Hello all,

we use the following Cisco Apps, which are working fine in general.

Cisco Networks App for Splunk Enterprise (https://splunkbase.splunk.com/app/1352)

Cisco Networks Add-on for Splunk Enterprise(https://splunkbase.splunk.com/app/1467)

When I edit the dashboard of the Cisco Networks App, I can find the following macro which should lead to the possiblity to select a "tenant".

Macro:

`get_tenants_for_user_role($env:user$)`

Expanded it looks like this:

inputlookup cisco_ios_tenants
| stats values(index) AS index BY tenant_name,roles
| eval index=mvjoin(index,",")
| eval index=replace(index,","," OR index=")
| eval index="index=" + index
| search [| rest splunk_server=local /services/authentication/users/$user$
| fields roles]

Unfortunatelly there is no lookup (definition) named cisco_ios_tenants, not in the App nor the Addon.

I also found in the default.xml nav that there should be a " <view name="cisco_networks_tenants" />"

This does also not exist.

I'm wondering on how that tentant support works and how it could be configured.

Does anymore has information about this? I was not able to find something.

Basically what we want to achieve (maybe there is a better way of doing it):

Our network colleagues want to have the possiblity to select the data based on something like a location/region or something. As the tentant macro is implemented nearly on all dashboards, I think that could be something to solve the problem.

Thanks in advance!

Many Regards

Michael

[gcusello]

Hi @deckemha,

I don't know this app, but usually there's a generating Lookup scheduled search to enable.

Check it in the alerts one of these apps.

Ciao.

Giuseppe

[deckemha]

Dear Giuseppe,

thanks for your reply.

That is something I've checked already. Unfortunatelly there are no saved searches / alerts in those apps doing things like creating a lookup, etc.

Many Regards

Michael

[gcusello]

Hi @deckemha,

when I need to monitor Cisco network appliances I usually use the Cisco Security Suite (https://splunkbase.splunk.com/app/5743), you could see if the features you're searching are also in this app.

Ciao.

Giuseppe

[deckemha]

Hello,

thanks for the hint.

For now we'll use the inital app without tenant support.

The requestor need some time to specifiy their exact requirements.

Thanks and many Regards

Michael

[gcusello]

Hi @deckemha,

if one answer solves your need, please accept one answer for the other people of Community or tell me how I can help you.

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉