For those using the Cisco eStreamer eNcore app and Cisco eStreamer eNcore add-on, could you verify which goes where? I think I missed those instructions in the documentation.
Add-on -> HF (linux), Indexers (linux)
App -> SH (linux)
The reason I'm asking is because I am not getting any data despite having a status of 'Running' in the dashboard on the Search Head.
On my HF when I look at the tcpdump I'm seeing data (encrypted so I don't know what data) moving between the FMC and the HF, but nothing is showing up in the cisco:estreamer:data sourcetype. All the boxes are checked under eStreamer Event Configuration on the FMC and also Log Extra Data, Log packets and Log Flows are checked on the Splunk app under eStreamer for Splunk:Settings.
There are no errors in /opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer.log or in the splunkd.log
Any other suggestions?
