https://community.splunk.com/t5/Getting-Data-In/Multiple-Indexes-from-single-Firepower-Management-Center/m-p/389846#M69774 <P>I too would like to know this. I have one FMC with multiple domains. I would like to send each domain to a custom index and/or be able to select the domain/index from the dashboard. I'm not sure of the best way to approach this.</P> Fri, 14 Feb 2020 17:59:31 GMT danbrook 2020-02-14T17:59:31Z https://community.splunk.com/t5/Getting-Data-In/Multiple-Indexes-from-single-Firepower-Management-Center/m-p/389845#M69773 <P>Hi</P> <P>Currently we have up to 20 eStreamer client/event indexes configured, one per FMC. </P> <P>We are looking at moving from a group of Firepower Management Centers to a single one (consolidation exercise). This would mean using multi-domain mode on the FMC to maintain the Firepower device segmentation per geographical region for and for security. An eStreamer client and certificate created per domain.</P> <P>In order to maintain the same event segmentation on Splunk via separate index; does Splunk support multiple indexes where the eStreamer server IP is the same? </P> <P>Thanks!</P> Fri, 28 Dec 2018 17:35:33 GMT https://community.splunk.com/t5/Getting-Data-In/Multiple-Indexes-from-single-Firepower-Management-Center/m-p/389845#M69773 cybermonkey101 2018-12-28T17:35:33Z https://community.splunk.com/t5/Getting-Data-In/Multiple-Indexes-from-single-Firepower-Management-Center/m-p/389846#M69774 <P>I too would like to know this. I have one FMC with multiple domains. I would like to send each domain to a custom index and/or be able to select the domain/index from the dashboard. I'm not sure of the best way to approach this.</P> Fri, 14 Feb 2020 17:59:31 GMT https://community.splunk.com/t5/Getting-Data-In/Multiple-Indexes-from-single-Firepower-Management-Center/m-p/389846#M69774 danbrook 2020-02-14T17:59:31Z