All Apps and Add-ons

Cisco eStreamer eNcore Add-on for Splunk: Encore seems to run but no data in Splunk

murat_ekren
Engager

Hi just installed the app , did the setup .
When checked splencore.sh status it seems to be running (had to remove the remark before the SPLUNK_HOME to make it run).
Also temp files under /opt/splunk/etc/apps/TA-estreamer/data is building .
All scripts and data file readers are enabled but somehow when I search for index=* sourcetype=cisco:estreamer:data nothing shows up (time range is set to All time).
Tried to remove the app restarted Splunk and reinstalled add-on nothing changed.
Anyone had the same problem?

0 Karma

douglashurd
Builder

what version of Firepower? eNcore? When you say app, you mean the TA?

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!