Currently we have up to 20 eStreamer client/event indexes configured, one per FMC.
We are looking at moving from a group of Firepower Management Centers to a single one (consolidation exercise). This would mean using multi-domain mode on the FMC to maintain the Firepower device segmentation per geographical region for and for security. An eStreamer client and certificate created per domain.
In order to maintain the same event segmentation on Splunk via separate index; does Splunk support multiple indexes where the eStreamer server IP is the same?
... View more