Troubleshoot the Splunk Add-on for Cisco ASA

For troubleshooting tips that you can apply to all add-ons, see Troubleshoot add-ons in Splunk Add-ons. For additional resources, see Support and resource links for add-ons in Splunk Add-ons.

CIM fields are mapped incorrectly after Cisco ASA Cloud Upgrade

If you find noncompliant values for CIM fields after you upgrade the Splunk Add-on for Cisco ASA in your cloud environment, it is likely that lookups have not been upgraded properly. Assuming you have no custom changes added to your lookups, you can replace all the lookup files while upgrading the add-on and not modify the lookups stanzas in props.conf.