Multiple Indexes from single Firepower Management Center

[cybermonkey101]

Hi

Currently we have up to 20 eStreamer client/event indexes configured, one per FMC.

We are looking at moving from a group of Firepower Management Centers to a single one (consolidation exercise). This would mean using multi-domain mode on the FMC to maintain the Firepower device segmentation per geographical region for and for security. An eStreamer client and certificate created per domain.

In order to maintain the same event segmentation on Splunk via separate index; does Splunk support multiple indexes where the eStreamer server IP is the same?

Thanks!

[danbrook]

I too would like to know this. I have one FMC with multiple domains. I would like to send each domain to a custom index and/or be able to select the domain/index from the dashboard. I'm not sure of the best way to approach this.