eStreamer data not showing in ES Intrusion Detection Datamodel after upgrade

[saadmalik83]

Hello All,

I am having an issue after upgrading our ES app from 4.0.0 to 4.5.2. Currently i am not getting the events in the ES, but if i run the following search "| datamodel Intrusion_Detection search | search sourcetype="eStreamer" " in the eStreamer app and the search app it would show me the results with the proper tags and the field values like "IDS_Attack.*" , but there are no results showing in the ES app.

I checked the permissions for the eStreamer app, the sourcefire TA, the fields, tags, datamodels and other related aspect and the permissions seems to be fine and they are set to global.

Any ideas guys?

Thanks !

[douglashurd]

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.