Reliability of Cisco eStreamer App

[viverma5]

Hi,

We are planning to use Cisco eStreamer App in our environment to link it with SPLUNK.
We are a bit cautious about this as it is primarily community supported and not supported by SPLUNK directly. If in future, something goes wrong with this app that who can be contacted and how can it be troubleshooted?
Also, do we need a separate license for this from the community that built it ?
Please assist me on this front

[douglashurd]

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

[eallanjr]

We use the eStreamer app in our deployment with very few issues. The only thing I've noticed is that occasionally when the Splunk daemon is restarted, events stop showing up in the app even though it still has a status of "Running". (To fix this usually I'll just disable/re-enable the eStreamer client in the app's GUI, and if necessary, manually run the estreamer_client.pl script in the app's bin directory.

No separate licensing is needed.

Don't let the fact that an app is community-supported deter you. There are some very good apps out there that aren't officially supported by Splunk and work just fine.

[ppablo]

Hi @viverma5

Usually if people have direct questions about an app, you can find the developer's contact information on the right hand side, bottom panel of the app's page. http://apps.splunk.com/app/1629/