Cisco eStreamer for Splunk: How to resolve the app being configured but not receiving logs?

[gcusello]

Hi at all,
I configured Cisco eStreamer for Splunk app (version Version 2.2.2, build 173) to pull events from a Cisco eStreamer version 5.4.1.8:

• firewall rules are OK (checked with Telnet);
• eStreamer for Splunk App is installed;
• all perl libraries are installed;
• eStreamer Certificate was generated, downloaded and copied on Splunk server;
• eStreamer for Splunk App was configured;
• eStreamer Client is running (status="eStreamer client is running."),
• eStreamer was configured to be ready to be connected by client.

But the problem is that I don't receive any log, only the ones from the client that confirm that it's running (sourcetype=client_check).

Where can i search a solution?

Thank you.
Bye.
Giuseppe.

[douglashurd]

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

[gcusello]

I found that there are no logs in $SPLUNK_HOME/etc/apps/eStreamer/log but the client is running.
Bye.
Giuseppe