Getting Data In

Multiple Indexes from single Firepower Management Center

New Member

Hi

Currently we have up to 20 eStreamer client/event indexes configured, one per FMC.

We are looking at moving from a group of Firepower Management Centers to a single one (consolidation exercise). This would mean using multi-domain mode on the FMC to maintain the Firepower device segmentation per geographical region for and for security. An eStreamer client and certificate created per domain.

In order to maintain the same event segmentation on Splunk via separate index; does Splunk support multiple indexes where the eStreamer server IP is the same?

Thanks!

0 Karma

Explorer

I too would like to know this. I have one FMC with multiple domains. I would like to send each domain to a custom index and/or be able to select the domain/index from the dashboard. I'm not sure of the best way to approach this.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!