https://community.splunk.com/t5/Splunk-Enterprise/Splunk-eStreamer-XFF-Original-Client-IP/m-p/536121#M4716 <P>Hi</P><P>I Send estreamer from FMC 6.7&nbsp; to Splunk 8.1 every things work fine&nbsp; except that I cant send original client ip address and HTTP response code.</P><P>extended option is enable in estreamer.conf:</P><P>"archiveTimestamps": true,<BR />"eventExtraData": true,<BR />"extended": true,<BR />"impactEventAlerts": true,<BR />"intrusion": true,<BR />"metadata": true,<BR />"packetData": true</P><P>&nbsp;</P><P>please help me</P><P>&nbsp;</P><P>thanks</P> Sat, 16 Jan 2021 17:52:20 GMT hrkh 2021-01-16T17:52:20Z https://community.splunk.com/t5/Splunk-Enterprise/Splunk-eStreamer-XFF-Original-Client-IP/m-p/536121#M4716 <P>Hi</P><P>I Send estreamer from FMC 6.7&nbsp; to Splunk 8.1 every things work fine&nbsp; except that I cant send original client ip address and HTTP response code.</P><P>extended option is enable in estreamer.conf:</P><P>"archiveTimestamps": true,<BR />"eventExtraData": true,<BR />"extended": true,<BR />"impactEventAlerts": true,<BR />"intrusion": true,<BR />"metadata": true,<BR />"packetData": true</P><P>&nbsp;</P><P>please help me</P><P>&nbsp;</P><P>thanks</P> Sat, 16 Jan 2021 17:52:20 GMT https://community.splunk.com/t5/Splunk-Enterprise/Splunk-eStreamer-XFF-Original-Client-IP/m-p/536121#M4716 hrkh 2021-01-16T17:52:20Z