All Apps and Add-ons

Ingesting logs from two eStreamer nodes

gcusello
SplunkTrust
SplunkTrust

Hi at all,
I have to ingest logs from two eStreamer nodes.
I'm already ingesting logs from the first one using eStreamer App 2.2.2, how can I have logs from the second one?

Could it be a solution to install two instances of the same app?
each one could take logs from one eStreamer node and both write on the same index, so using one App instance I could see all the logs.
I don't know if this could be a good solution.

Thank you in advance.

Bye.
Giuseppe

0 Karma
1 Solution

micahkemp
Champion

I've looked into this, and unfortunately the only answer (for this version, which works for Firepower 5) is to run the app on multiple forwarders, one forwarder per eStreamer node.

The good news is that this wouldn't prevent the events from going into the same index.

View solution in original post

0 Karma

micahkemp
Champion

I've looked into this, and unfortunately the only answer (for this version, which works for Firepower 5) is to run the app on multiple forwarders, one forwarder per eStreamer node.

The good news is that this wouldn't prevent the events from going into the same index.

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Thanks micahkemp,
Do you suggest to get data from two nodes in the same index?

is it possible to recognize event nodes?

Bye.
Giuseppe

0 Karma

douglashurd
Builder

If you move to version 6.x of firepower you will be best served to use the new TA: https://splunkbase.splunk.com/app/3662/

rafeeqsid25
New Member

https://splunkbase.splunk.com/app/3662/ this add-on is not suppported on Splunk Windows Environment.

0 Karma

micahkemp
Champion

The events should show the correct sensor that matched the traffic detected, but I'm not sure if the event would indicate which Firepower device the event was pulled over eStreamer from. That might be in the host field, but I don't have any eStreamer devices to test with.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Ok, I'll test it.
Thank you.
Giuseppe

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!