All Apps and Add-ons

How do you setup multiple instances of eStreamer from two different FMCs in two different domains to one Splunk Hvy Fwd

TheDairyGuy
Explorer

Scenario/Requirements:

  1. We have one eStreamer reporting from Firepower Management Console (FMC#1) to our Heavy Forwarder (HF#1) at HQ in Domain#1
  2. We have another eStreamer reporting from FMC#2 to our HF#2 in another location in Domain#2.
  3. We want to redirect FMC#2 in Domain#2 to send eStreamer reporting to the HF#1 in Domain#1.
  4. Have each eStreamer instance sending to two separate indexes with each instance running at a different time.

 

If I understand the documentation correctly, I cannot run two instances of eStreamer at the same time - and have to schedule them at separate times.
- How do I accomplish this?

Also, I have been under the impression that I need to clone the TA-estreamer add-on to a different directory, and then update the indexes.conf and inputs.conf - but not sure on what else I would need to change.

I would appreciate any help to get this working based on the scenario/requirements.

Labels (2)
0 Karma

TheDairyGuy
Explorer

However the following shows that it is possible:

eNcore Operations Guide v08:  Indicates in section 7.3 Frequently Asked Questions
Can I run more than one instance?
  • Yes, using the CLI version.
  • Although currently the encore.sh shell script only supports one instance. The underlying Python program prefixes temporary files (e.g., metadata, certificates, bookmarks) with the host and port. You will also need to update the outputter locations (e.g., [Splunk] … directory = splunk) in order to avoid data collision.
  • If you wish to run more than one instance, it is recommended to extract additional copies of eStreamer-eNcore and configure separately in order to avoid changing encore.sh.
Can I connect to more than one Firepower Management Center?
  • Currently not within a single instance. However, you can configure multiple instances as above.
Unfortunately, there is nothing more detailing the process. (edited) 
 
0 Karma

johnhuang
Motivator

I would recommend adding another HF before cloning add-ons because it will be tricky to maintain. Also 3rd party tools like Cribl would give you this flexibility.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...