All Apps and Add-ons

Why are no results displaying in Cisco eStreamer for Splunk app, but logs are appearing in $SPLUNK_HOME/etc/apps/eStreamer/log?


I have configured the Cisco eStreamer app, and confirmed that logs are appearing in Cisco eStreamer logs are in $SPLUNK_HOME/etc/apps/eStreamer/log. I have enabled verbose logging, but no logs are apearing in the Cisco eStreamer app, and when I do a search for index=estreamer it comes up empty. Additionally, when check the "client status" in the app, no results are returned.

I have manually checked the, and the status comes back as event_sec=1414616228 status_id=1 status="eStreamer client is running."

Also important: We have a distributed environment. I have tried to install the app on a search head and a heavy forwarder with no luck. I can not find any documentation so I am wondering if I need to install the app on an indexer instead. Any feedback would be appreciated.



0 Karma


As I suspected, I needed to install the application on an indexer, in addition to the search head. Using $SPLUNK_HOME/etc/apps/eStreamer/bin/ I was able to configure the app and then data began populating in the dashboard available on the search head.

The only issue with this configuration is that the estreamer index is not load balanced across our indexers (we have two). If I install the app on both indexers, this will result in duplicate events. If I figure out how to properly load balance I will let you know.

New Member

Not seeing any answers anywhere on where to install the esteamer_client in a distributed environment. Anyone have this answer yet on how to do this?

I would think if you installed it on ALL indexers they would all do the polling and have redundant data.

Is it confirmed that installing on a heavy forwarder (that doesn't index) will not work?

0 Karma

Path Finder

Did you ever figure out the correct way to load balance?

0 Karma


casey18cc - did you install the cert on the search head or the indexer?

0 Karma

Path Finder

Verbose logging writes a log to $SPLUNK_HOME/etc/apps/eStreamer/bin/estreamer_debug.log to give you a better idea what is happening with the app. If you're seeing logs populate in the $SPLUNK_HOME/etc/apps/eStreamer/log/ then the eStreamer log collection is functioning as anticipated.

In a multi-node setup, you may need to install the app on multiple nodes. Unfortunately I don't have much experience with such a setup, but I imagine you would need to install on both a forwarder and search head. My inexperience with this setup is the real reason for no documentation on the subject.

− Colin

0 Karma
Get Updates on the Splunk Community!

Dashboard Studio Challenge - Learn New Tricks, Showcase Your Skills, and Win Prizes!

Reimagine what you can do with your dashboards. Dashboard Studio is Splunk’s newest dashboard builder to ...

Introducing Edge Processor: Next Gen Data Transformation

We get it - not only can it take a lot of time, money and resources to get data into Splunk, but it also takes ...

Take the 2021 Splunk Career Survey for $50 in Amazon Cash

Help us learn about how Splunk has impacted your career by taking the 2021 Splunk Career Survey. Last year’s ...