Cisco Firepower App for Splunk : "no results found"

[joeri_fierens]

Hi all,
- Splunk Enterprise Version: 8.0.0 Build: 1357bef0a7f6
-Cisco Firepower App for Splunk version 1.3.7
-Cisco eStreamer eNcore for Splunk version 3.6.5

We've successfully setup estreamer between Splunk and our FMC, when I search in the Splunk events for sourcetype="cisco:estreamer:data", I see thousands of recent events (last 24 hours = 260416 events)

However, when I go to the Cisco firepower app for Splunk, all dashboards display "No results found".
I went over the documentation a few times, but as far as I can see, we did everything correctly.

Does anyone have an idea why the app doesn't seem to see/process the estreamer events?

Best regards,
Joeri

[chris_barrett]

The app defines a macro called FMC-index which, by default, refers to the main and estreamer indexes. If your events are not in either of those indexes then you'll need to change the macro's definition to refer to the correct index.

[joeri_fierens]

Hi Alex, it's a stand alone ubuntu server (test environment), so I guess it is not the same issue as you've experienced.
Joeri

[alexgwilkinson]

Hi Joeri,

Is this a Splunk cluster ? Or stand alone ?

Within a clustered environment I have found I needed the TA on both the index nodes AND search head nodes.

-Alex