Can the eStreamer app be configured to receive data from more than one SourceFire Defense Center?

[rwcbp]

During a phased migration to a newer SourceFire platform, multiple Defense Center appliances will be operating in the enterprise. If the Splunk eStreamer app cannot receive data from multiple Defense Centers there will be missing events in the indexed data during the migration period.

The web-based app configuration page has an entry field for a single certification. Can multiple certs be used by adding a second cert file and password line in the estreamer.conf file?

Example:
pkcs12_file = /opt/splunk/etc/apps/eStreamer/certs/0.0.0.0.pkcs12
pkcs12_password = ##########

[cgrady_sf · Accepted solution]

Currently the app only supports a single Defense Center (now FireSIGHT Management Center) per installation. If events need to be collected from multiple systems, one forwarder will need to be deployed for each.

• Colin