Hello everyone,
I have installed Splunk Stream on a distributed environment. All stream forwarders talk to the deployment server and have the "es" template applied/enabled as I use Enterprise Security.
Streams are normally populated (tcp, http, dns and many more).
I have added on my correlation searches a Stream Capture as an adaptive response action (a 15min capture for dest_ip). A notable event is triggered and under Adaptive Responses, I see mode:saved and status:success. When I click though on the "Stream Capture" link, I get zero results.
I followed this answer and I saw that there was already an event_type modmakestreams_results tagged as modaction_result as it was expected.
My final search is like:
tag=modaction_result orig_sid=scheduler__admin_REE.................... orig_rid=2 orig_action_name=makestreams
I see though that the event type of interest: source=stream:makestreams_* orig_sid=* brings no results. If I remove the orig_sid=* part I get results related to notable but not related to a stream capture.
As last information, stream capture on demand is working fine and pcaps are stored in the created NFS being able to download them.
Any help would be appreciated.
With kind regards,
Chris
