Splunk Enterprise Security

Do we need to upload missing estreamer logs to splunk or its automatic ?

utk123
Path Finder

My estreamer to device connection was down for sometime, so now I want to upload missing device logs to splunk.
I thought once the connection is established estreamer running on splunk will automatically pull missing logs from Device, but that's not happening.
I can follow steps listed on below link to upload missing logs to splunk, but not sure if the format would be same as the one pulled by estreamer?

http://docs.splunk.com/Documentation/SplunkLight/6.3.0/Gettingstarted/Uploadafile

0 Karma
1 Solution

lakshman239
Influencer

if you are using eStreamer add-on, you can place the file in the $SPLUNK_HOME/etc/apps/TA-eStreamer/data, the add-on will read/parse and send it to required indexers correctly. [ assuming the format is same as the original ones]

View solution in original post

0 Karma

lakshman239
Influencer

if you are using eStreamer add-on, you can place the file in the $SPLUNK_HOME/etc/apps/TA-eStreamer/data, the add-on will read/parse and send it to required indexers correctly. [ assuming the format is same as the original ones]

0 Karma
Get Updates on the Splunk Community!

Modern way of developing distributed application using OTel

Recently, I had the opportunity to work on a complex microservice using Spring boot and Quarkus to develop a ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...

Archived Metrics Now Available for APAC and EMEA realms

We’re excited to announce the launch of Archived Metrics in Splunk Infrastructure Monitoring for our customers ...