https://community.splunk.com/t5/Splunk-Enterprise-Security/Do-we-need-to-upload-missing-estreamer-logs-to-splunk-or-its/m-p/456020#M6440 <P>if you are using eStreamer add-on, you can place the file in the $SPLUNK_HOME/etc/apps/TA-eStreamer/data, the add-on will read/parse and send it to required indexers correctly. [ assuming the format is same as the original ones]</P> Wed, 09 Jan 2019 16:38:50 GMT lakshman239 2019-01-09T16:38:50Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Do-we-need-to-upload-missing-estreamer-logs-to-splunk-or-its/m-p/456019#M6439 <P>My estreamer to device connection was down for sometime, so now I want to upload missing device logs to splunk. <BR /> I thought once the connection is established estreamer running on splunk will automatically pull missing logs from Device, but that's not happening.<BR /> I can follow steps listed on below link to upload missing logs to splunk, but not sure if the format would be same as the one pulled by estreamer?</P> <P><A href="http://docs.splunk.com/Documentation/SplunkLight/6.3.0/Gettingstarted/Uploadafile">http://docs.splunk.com/Documentation/SplunkLight/6.3.0/Gettingstarted/Uploadafile</A></P> Wed, 31 Oct 2018 08:00:21 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Do-we-need-to-upload-missing-estreamer-logs-to-splunk-or-its/m-p/456019#M6439 utk123 2018-10-31T08:00:21Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Do-we-need-to-upload-missing-estreamer-logs-to-splunk-or-its/m-p/456020#M6440 <P>if you are using eStreamer add-on, you can place the file in the $SPLUNK_HOME/etc/apps/TA-eStreamer/data, the add-on will read/parse and send it to required indexers correctly. [ assuming the format is same as the original ones]</P> Wed, 09 Jan 2019 16:38:50 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Do-we-need-to-upload-missing-estreamer-logs-to-splunk-or-its/m-p/456020#M6440 lakshman239 2019-01-09T16:38:50Z