Does anyone know if the Splunk Add-on for Cisco IPS works on 6.4.x?

[larner]

Currently, the Splunkbase page for the Splunk Add-on for Cisco IPS only shows support up through 6.3

[hunters_splunk]

Cisco IPS 2.1.6 was just released today (Aug. 9) and the previous problem with connecting to Splunk platofrm 6.4 has been fixed in the latest version: http://splunkbase.splunk.com/app/1903

[rpille_splunk · Accepted solution]

Per the docs, the current version of the add-on cannot connect to Cisco IPS from Splunk platform version 6.4. It's a known issue.

http://docs.splunk.com/Documentation/AddOns/released/CiscoIPS/Releasenotes

[larner]

Thanks, I didn't think to check the release notes. I was hoping it was just an older version that hadn't been tested yet.

[hunters_splunk]

Please check out the latest release of Cisco IPS (http://splunkbase.splunk.com/app/1903 ), which has fixed the issue of failing to connect to Splunk 6.4. Thanks!

[klaxdal]

See my recent post regarding 6.4 and IPS - I have it working - no problems .

[klaxdal]

https://answers.splunk.com/answers/376881/splunk-add-on-for-cisco-ips-215-has-error-connetin.html