How do you setup multiple instances of eStreamer from two different FMCs in two different domains to one Splunk Hvy Fwd

[TheDairyGuy]

Scenario/Requirements:

1. We have one eStreamer reporting from Firepower Management Console (FMC#1) to our Heavy Forwarder (HF#1) at HQ in Domain#1
2. We have another eStreamer reporting from FMC#2 to our HF#2 in another location in Domain#2.
3. We want to redirect FMC#2 in Domain#2 to send eStreamer reporting to the HF#1 in Domain#1.
4. Have each eStreamer instance sending to two separate indexes with each instance running at a different time.

If I understand the documentation correctly, I cannot run two instances of eStreamer at the same time - and have to schedule them at separate times.
- How do I accomplish this?

Also, I have been under the impression that I need to clone the TA-estreamer add-on to a different directory, and then update the indexes.conf and inputs.conf - but not sure on what else I would need to change.

I would appreciate any help to get this working based on the scenario/requirements.

[TheDairyGuy]

However the following shows that it is possible:

eNcore Operations Guide v08:  Indicates in section 7.3 Frequently Asked Questions
Can I run more than one instance?

• Yes, using the CLI version.
• Although currently the encore.sh shell script only supports one instance. The underlying Python program prefixes temporary files (e.g., metadata, certificates, bookmarks) with the host and port. You will also need to update the outputter locations (e.g., [Splunk] … directory = splunk) in order to avoid data collision.
• If you wish to run more than one instance, it is recommended to extract additional copies of eStreamer-eNcore and configure separately in order to avoid changing encore.sh.

Can I connect to more than one Firepower Management Center?

• Currently not within a single instance. However, you can configure multiple instances as above.

Unfortunately, there is nothing more detailing the process. (edited) 

[johnhuang]

I would recommend adding another HF before cloning add-ons because it will be tricky to maintain. Also 3rd party tools like Cribl would give you this flexibility.