All Apps and Add-ons

How do you setup multiple instances of eStreamer from two different FMCs in two different domains to one Splunk Hvy Fwd

TheDairyGuy
Explorer

Scenario/Requirements:

  1. We have one eStreamer reporting from Firepower Management Console (FMC#1) to our Heavy Forwarder (HF#1) at HQ in Domain#1
  2. We have another eStreamer reporting from FMC#2 to our HF#2 in another location in Domain#2.
  3. We want to redirect FMC#2 in Domain#2 to send eStreamer reporting to the HF#1 in Domain#1.
  4. Have each eStreamer instance sending to two separate indexes with each instance running at a different time.

 

If I understand the documentation correctly, I cannot run two instances of eStreamer at the same time - and have to schedule them at separate times.
- How do I accomplish this?

Also, I have been under the impression that I need to clone the TA-estreamer add-on to a different directory, and then update the indexes.conf and inputs.conf - but not sure on what else I would need to change.

I would appreciate any help to get this working based on the scenario/requirements.

Labels (2)
0 Karma

TheDairyGuy
Explorer

However the following shows that it is possible:

eNcore Operations Guide v08:  Indicates in section 7.3 Frequently Asked Questions
Can I run more than one instance?
  • Yes, using the CLI version.
  • Although currently the encore.sh shell script only supports one instance. The underlying Python program prefixes temporary files (e.g., metadata, certificates, bookmarks) with the host and port. You will also need to update the outputter locations (e.g., [Splunk] … directory = splunk) in order to avoid data collision.
  • If you wish to run more than one instance, it is recommended to extract additional copies of eStreamer-eNcore and configure separately in order to avoid changing encore.sh.
Can I connect to more than one Firepower Management Center?
  • Currently not within a single instance. However, you can configure multiple instances as above.
Unfortunately, there is nothing more detailing the process. (edited) 
 
0 Karma

johnhuang
Motivator

I would recommend adding another HF before cloning add-ons because it will be tricky to maintain. Also 3rd party tools like Cribl would give you this flexibility.

Get Updates on the Splunk Community!

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...