New Cisco Meraki CCF Air Marshal Events - Fixed Timespan

[jamesglaves]

CiscoMeraki_PollerConfig.json

Thanks for the new CCF data connector and Meraki inventory data v-dhbedu_microsoft (@dhanunjaya1054), v-dhbedu !

But 604800 seconds timespan query parameter is being passed - which means it's pulling in 1 weeks worth of all Air Marshal events every hour? There's no start/from t0 parameter. So this is creating a lot of duplication.

https://developer.cisco.com/meraki/api-v1/get-network-wireless-air-marshal/

[dhanunjaya1054]

James G (@jamesglaves) - Thanks for reaching out to us. we're working on this issue, will keep you posted. Thanks!

[dhanunjaya1054]

James G (@jamesglaves) - The issue has been resolved, Could you please use the attached ARM template and let us know if the issue still persists. Thank You!

CiscoMerakiRESTAPIConnector.json

[dhanunjaya1054]

James G (@jamesglaves) - please let us know if the shared ARM template fixed the issue observed . Thanks!

[jamesglaves]

v-dhbedu_microsoft (@dhanunjaya1054) - the volume of Air Marshal events being ingested hasn't changed since I imported the new ARM template. Will it overwrite existing one added via Content Hub? Or do I need to uninstall/remove the Sentinel Meraki Data Connector first?

[jamesglaves]

[dhanunjaya1054]

James G (@jamesglaves) - Thanks for the update. Let me analyze the issue again and get back to you. Thanks!

[dhanunjaya1054]

James G (@jamesglaves) - Please find the attached maintemplate file that contains the fix. We've added t0 parameter to limit the logs

mainTemplate_0805.json

[jamesglaves]

v-dhbedu_microsoft (@dhanunjaya1054) - Thanks, I've imported this new template, but still no change in the Air Marshal event ingestion volumes. Just to confirm this will overwrite the existing data connector?

Also, I notice API spec states t0 is a string. I believe it should be 2026-08-06T11:00:00Z ISO 8601 format, not Unix Epoch timestamp format. Could this be an issue?