All Apps and Add-ons

Sourcefire Defense Center into Splunk for Sourcefire App - Windows

MrWh1t3
Path Finder

Hey all, does anyone know of a good set of instructions for getting the Splunk for Sourcefire app receiving data from a Sourcefire Defense Center (im running a DC 750). I got the app installed on Splunk, I have what I think is the proper configuration for estreamer, but it's not working. I have verified that the DC is sending SYSLOG events to Splunk so I know it's "talking", but I can't get anything into the Splunk for Sourcefire App.

I edited the config file with the ip of my DC as well. Still nothing.

Any thoughts? I'm running Splunk on Windows. I have Perl and Python installed.

0 Karma

lkouajie
New Member

THe estreamer app is only compatible with Unix platforms

0 Karma

MrWh1t3
Path Finder

Is this answer, "run Splunk on Linux"?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...