Getting Data In

Cisco Secure eStreamer Client Autolookup estreamer_fw_action commented out

elee_splunk
Loves-to-Learn Everything

After updating our TA we realized the action field autolookup wasn't working anymore. Digging through the TA I see in the props.conf the autolookup "LOOKUP-estreamer_fw_action" is commented out. Is there a reason this was done?

 

@douglashurd - Can you please advise. Thanks!

Labels (1)
0 Karma

douglashurd
Builder

Thanks for the question.  A few questions:

What event type did you lose the field in?

What version of the TA are you using?

Please email the details to encore-community@cisco.com for a slight quicker response.

 

Thanks,

 

Doug

0 Karma

elee_splunk
Loves-to-Learn Everything

I lost action field in the firewall rule logging cisco:estreamer:data. There is a field called fw_rule_action but there is supposed to be an autolookup that translates the fw_rule_action to action. 

I am using 4.6.0 but I downloaded and check 4.6.1 and 4.6.2 and all of them have the line for the autolookup commented out.

I have emailed encore-community@cisco.com for further support. 

 

Thanks!

0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...