Logs from Firepower not indexing in Splunk

Hugo — Thu, 02 Dec 2021 15:50:11 GMT

Hi All,

We have two splunk environments 8.2, and I am in charge of these two. On the first environment, everything works fine. I'm trying to configure the same thing on the second for another infrastructure.

To explain a little : I have two heavy forwarders behind a VIP, and then logs are forwarded to an indexer cluster of two indexers.

I had configure some syslog forwarding for network devices, and everything works fine in TCP or UDP, my logs are showing in the Search Head, in the good index.

But for Firepower, impossible to indexing datas, I use TCP 10000 and with a tcpdump on the HF I see logs arrives, but after that nothing...

I've checked splunkd.logs (and nearly all log file on the servers), there are no errors on the HF or the Indexers and nothing is blocked by a firewall or the network.

I don't use estreamer add-on and firepower add-on, and on the first infrastructure is working fine in the same configuration.

Here are some configurations :

On Indexers :

[fw_ext]
homePath = volume:primary/fw_ext/db
coldPath = volume:primary/fw_ext/colddb
thawedPath = $SPLUNK_DB/fw_ext/thaweddb
repFactor = auto
maxHotBuckets=10

On HF :

[tcp://10000]
index = fw_ext
sourcetype = cisco:asa
connection_host = ip
disabled = 0

Paths are empty for the index fw_ext, so I presume that the logs don't arrives to the Indexers.

On the Firepower, configuration for the first and the second infrastructures are identical, so I presume that the problem don't come from the device too.

The forwarding configuration is good too since it works for every other network devices and servers.

Have you guys any ideas ?

Thanks by advance.

topic Logs from Firepower not indexing in Splunk in Getting Data In

Logs from Firepower not indexing in Splunk