topic Re: Cisco Secure eStreamer Client Autolookup estreamer_fw_action commented out in Getting Data In

Cisco Secure eStreamer Client Autolookup estreamer_fw_action commented out

elee_splunk — Tue, 06 Jul 2021 18:00:11 GMT

After updating our TA we realized the action field autolookup wasn't working anymore. Digging through the TA I see in the props.conf the autolookup "LOOKUP-estreamer_fw_action" is commented out. Is there a reason this was done?

@douglashurd - Can you please advise. Thanks!

Re: Cisco Secure eStreamer Client Autolookup estreamer_fw_action commented out

douglashurd — Tue, 06 Jul 2021 23:42:14 GMT

Thanks for the question. A few questions:

What event type did you lose the field in?

What version of the TA are you using?

Please email the details to encore-community@cisco.com for a slight quicker response.

Thanks,

Doug

Re: Cisco Secure eStreamer Client Autolookup estreamer_fw_action commented out

elee_splunk — Wed, 07 Jul 2021 16:30:10 GMT

I lost action field in the firewall rule logging cisco:estreamer:data. There is a field called fw_rule_action but there is supposed to be an autolookup that translates the fw_rule_action to action.

I am using 4.6.0 but I downloaded and check 4.6.1 and 4.6.2 and all of them have the line for the autolookup commented out.

I have emailed encore-community@cisco.com for further support.

Thanks!