https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-isn-t-the-Cisco-eStreamer-for-Splunk-app-not-polling/m-p/558343#M66042 <P>check the field rec_type_category=RNA</P> Tue, 06 Jul 2021 02:28:30 GMT carlospalm 2021-07-06T02:28:30Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-isn-t-the-Cisco-eStreamer-for-Splunk-app-not-polling/m-p/236596#M26673 <P>We have the FMC set to send connection events, and they are turned on in the Access Policies (set to just send to the FMC, not syslog) and when we first started up eStreamer, we got a large burst of events, but then they seemed to stop.</P> <P>If I look in the <CODE>_app_path_/log/</CODE> directory, I see a large number of estreamer.log.<EM>timestamp</EM> files. Are those supposed to be imported into the system by the .pl that runs?</P> Tue, 23 Aug 2016 21:41:38 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-isn-t-the-Cisco-eStreamer-for-Splunk-app-not-polling/m-p/236596#M26673 jthoel 2016-08-23T21:41:38Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-isn-t-the-Cisco-eStreamer-for-Splunk-app-not-polling/m-p/236597#M26674 <P>Yes, I think we are having the same issue. The Connection Events data (in splunk it's labeled as rec_type_simple=RNA) are coming over sporadically.</P> <P>The other types of data coming over through eStreamer seem to be coming over constantly, but the RNA data is on and off.</P> <P>Anyone have any ideas to try?</P> Tue, 29 Sep 2020 11:03:51 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-isn-t-the-Cisco-eStreamer-for-Splunk-app-not-polling/m-p/236597#M26674 tommyblanchard 2020-09-29T11:03:51Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-isn-t-the-Cisco-eStreamer-for-Splunk-app-not-polling/m-p/236598#M26675 <P>A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:</P> <P>eStreamer eNcore<BR /> <A href="https://splunkbase.splunk.com/app/3662/">https://splunkbase.splunk.com/app/3662/</A></P> <P>eNcore Dashboard<BR /> <A href="https://splunkbase.splunk.com/app/3663/">https://splunkbase.splunk.com/app/3663/</A></P> <P>It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.</P> <P>Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.</P> Wed, 02 Aug 2017 23:17:04 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-isn-t-the-Cisco-eStreamer-for-Splunk-app-not-polling/m-p/236598#M26675 douglashurd 2017-08-02T23:17:04Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-isn-t-the-Cisco-eStreamer-for-Splunk-app-not-polling/m-p/558343#M66042 <P>check the field rec_type_category=RNA</P> Tue, 06 Jul 2021 02:28:30 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Why-isn-t-the-Cisco-eStreamer-for-Splunk-app-not-polling/m-p/558343#M66042 carlospalm 2021-07-06T02:28:30Z