Deployment Architecture

How do you set up forwarding from Cisco's Firepower Event Streamer (eStreamer) to Splunk Cloud?

New Member

I have set up a TCP connection from Splunk to Cisco's Firepower eStreamer. I am trying to figure out how to best forward events from Firepower to Splunk cloud. My idea was to install a heavy forwarder first, connect that through a TCP connection to firepower, then filter on the heavy forwarder and send to Splunk.

After connecting the heavy forwarder to Firepower I don't see any events being generated. Any tips on trouble shooting or is there a better way to do this?

0 Karma

Esteemed Legend

Hi Dijanad,
did you followed the instructions ( )?
because there's a perl client to enable and configure to extract data.

About the idea to use an Heavy Forwarder to filter and route data to Splunk Cloud, this is a best practice.

In addition, remember that you need of an Heavy Forwarder for each eStreamer node.


0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...