Getting Data In

Multiple Indexes from single Firepower Management Center

cybermonkey101
New Member

Hi

Currently we have up to 20 eStreamer client/event indexes configured, one per FMC.

We are looking at moving from a group of Firepower Management Centers to a single one (consolidation exercise). This would mean using multi-domain mode on the FMC to maintain the Firepower device segmentation per geographical region for and for security. An eStreamer client and certificate created per domain.

In order to maintain the same event segmentation on Splunk via separate index; does Splunk support multiple indexes where the eStreamer server IP is the same?

Thanks!

0 Karma

danbrook
Explorer

I too would like to know this. I have one FMC with multiple domains. I would like to send each domain to a custom index and/or be able to select the domain/index from the dashboard. I'm not sure of the best way to approach this.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...