All Apps and Add-ons

Splunk Cisco IPS Setup

promax
New Member

Hello, Just started using Splunk, i added two sensors through the web setup of Cisco IPS. I don't see any IPS data in splunk yet. For trouble shooting a did a search with:

index="_internal" sourcetype="sdee_connection" 

and get the error message:

ERROR - Connecting to sensor - 10.90.99.52: ExpatError: not well-formed (invalid token): line 5, column 192

I don't get the meaning of this error, can someone help?

Thanks,
Leon

0 Karma

dleung
Splunk Employee
Splunk Employee

Hi Leon, it looks like there might be some special characters in the IPS data that is not parsing correctly. We can further examine with sample XML export of the IPS data. Can you please contact Splunk support and we can go from there. Thanks, Danny.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...