Getting Data In

no logs from cisco eStreamer

rashid47010
Communicator

although connection is successful but still I am not seeing the logs from eStreamer. whereas in DR I am getting continuously logs.

can anyone share the troubleshooting steps.

0 Karma

DavidHourani
Super Champion

Hi @rashid47010,

Do you still have this problem ?
Please have a look at your _intnernal splunkd logs for any error related to your connector.

If you're looking for the documentation for the connector it can be found here :
https://www.cisco.com/c/en/us/td/docs/security/firepower/630/api/eStreamer_enCore/eStreamereNcoreSpl...

Cheers,
David

0 Karma

rashid47010
Communicator

Hi David,

I follow that document as almost all the FMC's are updated to version 6.x.

for 1x.2x.6.x8, I reinstall the latest TA and I can see the logs for crosspoinding sensors but these logs does not make any sense to me as compare to logs from other FMC's.

I will send you log snapshot seperately.

0 Karma

koshyk
Super Champion

your query is vague. Please put your sample estreamer config, DR system conf which is working etc.

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...