All Apps and Add-ons

Why are no results displaying in Cisco eStreamer for Splunk app, but logs are appearing in $SPLUNK_HOME/etc/apps/eStreamer/log?


I have configured the Cisco eStreamer app, and confirmed that logs are appearing in Cisco eStreamer logs are in $SPLUNK_HOME/etc/apps/eStreamer/log. I have enabled verbose logging, but no logs are apearing in the Cisco eStreamer app, and when I do a search for index=estreamer it comes up empty. Additionally, when check the "client status" in the app, no results are returned.

I have manually checked the, and the status comes back as event_sec=1414616228 status_id=1 status="eStreamer client is running."

Also important: We have a distributed environment. I have tried to install the app on a search head and a heavy forwarder with no luck. I can not find any documentation so I am wondering if I need to install the app on an indexer instead. Any feedback would be appreciated.



0 Karma


As I suspected, I needed to install the application on an indexer, in addition to the search head. Using $SPLUNK_HOME/etc/apps/eStreamer/bin/ I was able to configure the app and then data began populating in the dashboard available on the search head.

The only issue with this configuration is that the estreamer index is not load balanced across our indexers (we have two). If I install the app on both indexers, this will result in duplicate events. If I figure out how to properly load balance I will let you know.

New Member

Not seeing any answers anywhere on where to install the esteamer_client in a distributed environment. Anyone have this answer yet on how to do this?

I would think if you installed it on ALL indexers they would all do the polling and have redundant data.

Is it confirmed that installing on a heavy forwarder (that doesn't index) will not work?

0 Karma

Path Finder

Did you ever figure out the correct way to load balance?

0 Karma


casey18cc - did you install the cert on the search head or the indexer?

0 Karma

Path Finder

Verbose logging writes a log to $SPLUNK_HOME/etc/apps/eStreamer/bin/estreamer_debug.log to give you a better idea what is happening with the app. If you're seeing logs populate in the $SPLUNK_HOME/etc/apps/eStreamer/log/ then the eStreamer log collection is functioning as anticipated.

In a multi-node setup, you may need to install the app on multiple nodes. Unfortunately I don't have much experience with such a setup, but I imagine you would need to install on both a forwarder and search head. My inexperience with this setup is the real reason for no documentation on the subject.

− Colin

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...