All Apps and Add-ons

Cisco eStreamer eNcore Add-on for Splunk: Encore seems to run but no data in Splunk

murat_ekren
Engager

Hi just installed the app , did the setup .
When checked splencore.sh status it seems to be running (had to remove the remark before the SPLUNK_HOME to make it run).
Also temp files under /opt/splunk/etc/apps/TA-estreamer/data is building .
All scripts and data file readers are enabled but somehow when I search for index=* sourcetype=cisco:estreamer:data nothing shows up (time range is set to All time).
Tried to remove the app restarted Splunk and reinstalled add-on nothing changed.
Anyone had the same problem?

0 Karma

douglashurd
Builder

what version of Firepower? eNcore? When you say app, you mean the TA?

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...