All Apps and Add-ons

Cisco eStreamer App in Splunk doesn't get Flow logs

gaddams
Explorer

I have installed Cisco eStreamer app in Splunk and configured to get data from Sourcefire defense center. I am able to see different logs in the eStreamer App dashboard but the Flow logs are "0". I don't see and flow logs.
Could you let me know if there is any additional setting that I need to configure on the Sourcefire or on the Splunk app?

Thanks
Swetha

0 Karma
1 Solution

cgrady_sf
Path Finder

Be sure you enable the "Discovery Events" from the System > Local > Registration page on the Defense Center. That is where the flow logs are enabled in eStreamer. Additionally, you will need to enable connection logging in your Access Control policy.

I apologize for not responding earlier -- I've been out of town on business.

Thanks for your interest in eStreamer for Splunk.

Colin Grady

View solution in original post

gaddams
Explorer

Thanks Colin. This worked! We are able to see the flow logs in Splunk.

Thanks
Swetha

0 Karma

cgrady_sf
Path Finder

Be sure you enable the "Discovery Events" from the System > Local > Registration page on the Defense Center. That is where the flow logs are enabled in eStreamer. Additionally, you will need to enable connection logging in your Access Control policy.

I apologize for not responding earlier -- I've been out of town on business.

Thanks for your interest in eStreamer for Splunk.

Colin Grady

kheli
Path Finder

Will this also support Host Discovery events? Thank you.

0 Karma

gaddams
Explorer

Thanks Colin. This worked. We are able to see flow logs in Splunk.

Thanks
Swetha

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...