All Apps and Add-ons
Highlighted

Cisco Firepower App for Splunk : "no results found"

New Member

Hi all,
- Splunk Enterprise Version: 8.0.0 Build: 1357bef0a7f6
-Cisco Firepower App for Splunk version 1.3.7
-Cisco eStreamer eNcore for Splunk version 3.6.5

We've successfully setup estreamer between Splunk and our FMC, when I search in the Splunk events for sourcetype="cisco:estreamer:data", I see thousands of recent events (last 24 hours = 260416 events)

However, when I go to the Cisco firepower app for Splunk, all dashboards display "No results found".
I went over the documentation a few times, but as far as I can see, we did everything correctly.

Does anyone have an idea why the app doesn't seem to see/process the estreamer events?

Best regards,
Joeri

0 Karma
Highlighted

Re: Cisco Firepower App for Splunk : "no results found"

Explorer

Hi Joeri,

Is this a Splunk cluster ? Or stand alone ?

Within a clustered environment I have found I needed the TA on both the index nodes AND search head nodes.

-Alex

0 Karma
Highlighted

Re: Cisco Firepower App for Splunk : "no results found"

New Member

Hi Alex, it's a stand alone ubuntu server (test environment), so I guess it is not the same issue as you've experienced.
Joeri

0 Karma
Highlighted

Re: Cisco Firepower App for Splunk : "no results found"

Path Finder

The app defines a macro called FMC-index which, by default, refers to the main and estreamer indexes. If your events are not in either of those indexes then you'll need to change the macro's definition to refer to the correct index.

0 Karma