Splunk Enterprise Security

Do we need to upload missing estreamer logs to splunk or its automatic ?

utk123
Path Finder

My estreamer to device connection was down for sometime, so now I want to upload missing device logs to splunk.
I thought once the connection is established estreamer running on splunk will automatically pull missing logs from Device, but that's not happening.
I can follow steps listed on below link to upload missing logs to splunk, but not sure if the format would be same as the one pulled by estreamer?

http://docs.splunk.com/Documentation/SplunkLight/6.3.0/Gettingstarted/Uploadafile

0 Karma
1 Solution

lakshman239
Influencer

if you are using eStreamer add-on, you can place the file in the $SPLUNK_HOME/etc/apps/TA-eStreamer/data, the add-on will read/parse and send it to required indexers correctly. [ assuming the format is same as the original ones]

View solution in original post

0 Karma

lakshman239
Influencer

if you are using eStreamer add-on, you can place the file in the $SPLUNK_HOME/etc/apps/TA-eStreamer/data, the add-on will read/parse and send it to required indexers correctly. [ assuming the format is same as the original ones]

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.


Introducing Unified TDIR with the New Enterprise Security 8.2

Read the blog

Can’t make it to .conf25? Join us online!

Get Updates on the Splunk Community!

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...

Splunkbase Unveils New App Listing Management Public Preview

Splunkbase Unveils New App Listing Management Public PreviewWe're thrilled to announce the public preview of ...

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Are you leveraging automation to its fullest potential in your threat detection strategy?Our upcoming Security ...