Cisco Firepower eNcore App for Splunk for multiple FMC

[hr_t2000]

HI

I have splunk with Cisco estreamer eNcore App for ONE FMC, it works fine for single FMC

BUT , i have four fmc in netowrk .

how i add multiple fmc in one splunk

please help me

thanks

[scelikok]

Hi @hr_t2000, 

Unfortunately eStreamer client supports connection to only one FMC. You should use separate Splunk Heavy Forwarder instances for each FMC.

If this reply helps you , an upvote is appreciated.

[hr_t2000]

thanks for reply

excuse me , are you sure ?

Because , this link

https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-connect-multiple-instances-of-Cisc...

said it possible .🙄😕

[scelikok]

Yes, it is an option but that way it becomes custom solution, upgrades and debugging may be a problem. I used eStreamer app and noticed performance problems on python if there is high volume of data. That is why if you run 4 instance on the the same host, it may be nightmare.