Deployment Architecture

How do you set up forwarding from Cisco's Firepower Event Streamer (eStreamer) to Splunk Cloud?

New Member

I have set up a TCP connection from Splunk to Cisco's Firepower eStreamer. I am trying to figure out how to best forward events from Firepower to Splunk cloud. My idea was to install a heavy forwarder first, connect that through a TCP connection to firepower, then filter on the heavy forwarder and send to Splunk.

After connecting the heavy forwarder to Firepower I don't see any events being generated. Any tips on trouble shooting or is there a better way to do this?

0 Karma

Esteemed Legend

Hi Dijanad,
did you followed the instructions ( )?
because there's a perl client to enable and configure to extract data.

About the idea to use an Heavy Forwarder to filter and route data to Splunk Cloud, this is a best practice.

In addition, remember that you need of an Heavy Forwarder for each eStreamer node.


0 Karma
Get Updates on the Splunk Community!

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...

Data Preparation Made Easy: SPL2 for Edge Processor

By now, you may have heard the exciting news that Edge Processor, the easy-to-use Splunk data preparation tool ...