All Apps and Add-ons

Cisco eStreamer eNcore Add-on for Splunk: Encore seems to run but no data in Splunk

murat_ekren
Engager

Hi just installed the app , did the setup .
When checked splencore.sh status it seems to be running (had to remove the remark before the SPLUNK_HOME to make it run).
Also temp files under /opt/splunk/etc/apps/TA-estreamer/data is building .
All scripts and data file readers are enabled but somehow when I search for index=* sourcetype=cisco:estreamer:data nothing shows up (time range is set to All time).
Tried to remove the app restarted Splunk and reinstalled add-on nothing changed.
Anyone had the same problem?

0 Karma

douglashurd
Builder

what version of Firepower? eNcore? When you say app, you mean the TA?

0 Karma
Get Updates on the Splunk Community!

New Case Study Shows the Value of Partnering with Splunk Academic Alliance

The University of Nevada, Las Vegas (UNLV) is another premier research institution helping to shape the next ...

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...