All Apps and Add-ons

splunk Dont read the estreamer lookups

ahmadjabr
Engager

hello,

in my testing env, I have installed streamer encore addon, firesight addon and ES.
and I have configured the eStreamer and its working good. and renamed the sourcetype from cisco:estreamer:data to Cisco:Sourcefire
this should make the data from the firesight device to work and to fill ES dashboards, but there is only one dashboard is working which is intrusion center, on other dashboards I find out the Splunk don't apply the alises(lookups).csv files on the events and this is why it don't fill the dashboards.

so how to fix it or troubleshoot the issue id depth

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!