cisco-en-programmability / splunk-apps Goto Github PK

I have a question about the cisco_dnac_issue. I understand that the app issues and then query issue enrichment details, sites, network-device on every issues. I have many issues, around 300-500 issues in my DNAC. So the app sends too many queries to DNAC. If I would like to limit the number of query by only enabling the app to query issue but not the issue enrichment details, site, and network-device, Do you have any suggestion on how I should update the source code? or To add the filter based on the issue severity to limit the number of issues, what is the best way to edit the code? Can I edit the source code in $SPLUNK/etc/app/Splunk-TA-cisco-datacenter/bin?

I see that it is recommended to add the input logic to file input_module_cisco_dnac_issue.py. Should I put the filter into this "input_module_cisco_dnac_issue.py" file?

Appreciated.

Thanks,
Phithakkit

Hi

I installed and configured your APP and Add On for DNAC.
All is working well except the collect for cisco_dnac_networkhealth
I got some informations regarding this sourcetype the first time I launch the collect and since this time I didn't receive any information for networkhealth
I enable loglevel = DEBUG, see lot of logs in the log file splunk_ta_cisco_dnacenter_cisco_dnac_networkhealth.log but there is no error/no warning, all seems to be ok but I don't see corresponding data in my index

Do you have any idea of what happened ?
thanks in advance
regards

Are the clients MAC address collected with the Splunk add-on ?
I can't find it in the collected data in Splunk.

Hi Expert,

Does the Splunk DNAC add-on App support Splunk Cloud using IDM as the forwarder?

Thanks,
Phithakkit

Hi
Thanks for the great apps for splunk!!

Just curious, do you have any update on submitting them on SplunkBase?

If not, is it possible to submit to Cisco devnet? https://developer.cisco.com/network-automation/listing/#

Any help would be appreciated.

Thanks

I'm adding users, selecting an nput to use that user account with. Regardless if the account is successful authenticating or not Splunk treats the input as if everything if fine. On the back end _internal logs I can see a lot of .py errors each time we try to modify an input. The py errors aren't that helpful in determining the actual problem

Can we fix the TA so it works to show auth errors? Bake in exactly what the issue is as of now I'm not able to use the TA. Account used is an admin in DNA and it still doesn't work to pull data in. Setup seems correct, Some messaging as to why logs aren't working would be helpful

Hello Team,

I'm not able to receive any data from DNAC.
I've installed the Splunk_CiscoDNACenter.spl first and then Splunk-TA-cisco-dnacenter.spl.
On Cisco DNA Center Add-on > Input: I've created the input with the DNAC VIP Management Address
On Configuration, I've created the account with DNAC credential.
DNAC and Splunk are reachable from DNAC management VIP (Cluster of 3 nodes)
Do I need to configure something on DNAC side?

I'll really appreciate your support.