All Apps and Add-ons

Why are no results displaying in Cisco eStreamer for Splunk app, but logs are appearing in $SPLUNK_HOME/etc/apps/eStreamer/log?

casey18cc
Explorer

I have configured the Cisco eStreamer app, and confirmed that logs are appearing in Cisco eStreamer logs are in $SPLUNK_HOME/etc/apps/eStreamer/log. I have enabled verbose logging, but no logs are apearing in the Cisco eStreamer app, and when I do a search for index=estreamer it comes up empty. Additionally, when check the "client status" in the app, no results are returned.

I have manually checked the client_check.py, and the status comes back as event_sec=1414616228 status_id=1 status="eStreamer client is running."

Also important: We have a distributed environment. I have tried to install the app on a search head and a heavy forwarder with no luck. I can not find any documentation so I am wondering if I need to install the app on an indexer instead. Any feedback would be appreciated.

Thanks,

Casey

0 Karma

casey18cc
Explorer

As I suspected, I needed to install the application on an indexer, in addition to the search head. Using $SPLUNK_HOME/etc/apps/eStreamer/bin/config_nogui.sh I was able to configure the app and then data began populating in the dashboard available on the search head.

The only issue with this configuration is that the estreamer index is not load balanced across our indexers (we have two). If I install the app on both indexers, this will result in duplicate events. If I figure out how to properly load balance I will let you know.

hopnscotch6
New Member

Not seeing any answers anywhere on where to install the esteamer_client in a distributed environment. Anyone have this answer yet on how to do this?

I would think if you installed it on ALL indexers they would all do the polling and have redundant data.

Is it confirmed that installing on a heavy forwarder (that doesn't index) will not work?

0 Karma

willamwar
Path Finder

Did you ever figure out the correct way to load balance?

0 Karma

pil321
Communicator

casey18cc - did you install the cert on the search head or the indexer?

0 Karma

cgrady_sf
Path Finder

Verbose logging writes a log to $SPLUNK_HOME/etc/apps/eStreamer/bin/estreamer_debug.log to give you a better idea what is happening with the app. If you're seeing logs populate in the $SPLUNK_HOME/etc/apps/eStreamer/log/ then the eStreamer log collection is functioning as anticipated.

In a multi-node setup, you may need to install the app on multiple nodes. Unfortunately I don't have much experience with such a setup, but I imagine you would need to install on both a forwarder and search head. My inexperience with this setup is the real reason for no documentation on the subject.

− Colin

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...