I was finally able to make Cisco eStreamer work on Windows platforms, but ...

[lkouajie]

With the help of a Cisco TAC engineer, I was able to make the eStreamer SDK compatible with Windows via a slight modification of its Perl module SFPkcs12.pm. However, when I migrate the change over to the Cisco eStreamer for Splunk app, the app doesn't cooperate. I suspect it has to do with the way the app integrates the eStreamer SDK. Unfortunately, the app integration is written in Python and I'm not a Python guru. Can anyone help me with that fix or know how to get in touch with the app owner Douglas Hurd?

Thanks in advance.

[douglashurd]

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

Written in Python. Windows not supported yet but might work OK.

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.