This is late, but I took this from someone having the same issue with the TA for Cisco IPS. This only happened after I forgot to disable SSL.
Regardless, this worked for me
Navigate to $SPLUNK_HOME/etc/apps/TA_cisco-ACI
Remove app.conf
Remove passwords.conf
Try again
... View more
Hello,
I need to spoof some data and am using |makeresults for 3 hosts and their port status of "UP" (and eventually "DOWN")
| makeresults
| eval _raw = "host1%UP%UP%UP%#host2%UP%UP%UP%#host3%UP%UP%UP%"
| rex max_match=0 "(?P<_raw>[^#]+)"
| mvexpand _raw
| table _time _raw
| rex "(?P[^\%]+)%(?P[^\%]+)%(?P[^\%]+)%(?P[^\%]+)"
| table _time host Port1 Port2 Port3
This gives me 3 lines for the result but _time shows only on the first result for "host1"
Question: How do I get the above search show _time for the all 3 results?
Thank you.
... View more
Hi,
The Service Analyzer screen appears to be static and does not change after initial viewing of the Services and KPI's.
I would like to see the screen refresh every 5 minutes, but I can't seem to find the documentation on how to do this (assuming that my first statement is correct).
So, my questions are:
1) Is there a setting for this?
2) If so, what .conf file and parameter is it?
Thank you.
... View more