All Apps and Add-ons

Correct configuration of Cisco Firepower eNcore

reswob4
Builder

For those using the Cisco eStreamer eNcore app and Cisco eStreamer eNcore add-on, could you verify which goes where? I think I missed those instructions in the documentation.

Add-on -> HF (linux), Indexers (linux)

App -> SH (linux)

The reason I'm asking is because I am not getting any data despite having a status of 'Running' in the dashboard on the Search Head.

On my HF when I look at the tcpdump I'm seeing data (encrypted so I don't know what data) moving between the FMC and the HF, but nothing is showing up in the cisco:estreamer:data sourcetype. All the boxes are checked under eStreamer Event Configuration on the FMC and also Log Extra Data, Log packets and Log Flows are checked on the Splunk app under eStreamer for Splunk:Settings.

There are no errors in /opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer.log or in the splunkd.log

Any other suggestions?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...