Cisco eStreamer App in Splunk doesn't get Flow logs

[gaddams]

I have installed Cisco eStreamer app in Splunk and configured to get data from Sourcefire defense center. I am able to see different logs in the eStreamer App dashboard but the Flow logs are "0". I don't see and flow logs.
Could you let me know if there is any additional setting that I need to configure on the Sourcefire or on the Splunk app?

Thanks
Swetha

[gaddams]

Thanks Colin. This worked! We are able to see the flow logs in Splunk.

Thanks
Swetha

[cgrady_sf · Accepted solution]

Be sure you enable the "Discovery Events" from the System > Local > Registration page on the Defense Center. That is where the flow logs are enabled in eStreamer. Additionally, you will need to enable connection logging in your Access Control policy.

I apologize for not responding earlier -- I've been out of town on business.

Thanks for your interest in eStreamer for Splunk.

Colin Grady

[kheli]

Will this also support Host Discovery events? Thank you.

[gaddams]

Thanks Colin. This worked. We are able to see flow logs in Splunk.

Thanks
Swetha