https://community.splunk.com/t5/Getting-Data-In/Cisco-eStreamer-encore-8-1-2-Data-Ingestion-Issue/m-p/576086#M101807 <P>The inputs.conf had the stanza pointing to the wrong directory, also sourcetype name was missing after the upgrade. Had to connect the path and add the sourcetype name to fix</P> Tue, 23 Nov 2021 20:58:58 GMT km1986 2021-11-23T20:58:58Z https://community.splunk.com/t5/Getting-Data-In/Cisco-eStreamer-encore-8-1-2-Data-Ingestion-Issue/m-p/574518#M101559 <P><SPAN>Hi All, I have recently upgraded Splunk HF from 7.3.x to 8.1.2 and also the Cisco eStreamer (Encore) app from 3.6.x to 4.8.1. Both upgrades went fine and cisco:estreamer:data logs were coming in fine till 1.5 hours post-upgrade after which logs stopped coming in. The file&nbsp; estreamer.log in /opt/splunk/etc/apps/TA-eStreamer/bin/encore doest show any ERROR ( INFO&nbsp;&nbsp;&nbsp;&nbsp; Running. 3500 handled; average rate 4.86 ev/sec;). Also, I'm able to see logs populating in /opt/splunk/etc/apps/TA-eStreamer/data. However, it appears logs are not getting updated in cisco:estreamer:data sourcetype. There are other log sources relayed from the HF to cloud which do not have any issues (ruled out any network connectivity issues between HF and splunkcloud). Has anyone else seen similar issues?</SPAN></P> Thu, 11 Nov 2021 04:28:54 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-eStreamer-encore-8-1-2-Data-Ingestion-Issue/m-p/574518#M101559 km1986 2021-11-11T04:28:54Z https://community.splunk.com/t5/Getting-Data-In/Cisco-eStreamer-encore-8-1-2-Data-Ingestion-Issue/m-p/576086#M101807 <P>The inputs.conf had the stanza pointing to the wrong directory, also sourcetype name was missing after the upgrade. Had to connect the path and add the sourcetype name to fix</P> Tue, 23 Nov 2021 20:58:58 GMT https://community.splunk.com/t5/Getting-Data-In/Cisco-eStreamer-encore-8-1-2-Data-Ingestion-Issue/m-p/576086#M101807 km1986 2021-11-23T20:58:58Z