Hi, I have several Defense Center (without Master Defense Center) and therefore I am trying to run multiple instances of Cisco eStreamer for Splunk on my Splunk server to interface with all my DCs. Here's what I did: So far I have duplicated eStreamer original app directory with a different name like "eStreamer2". I edited local/estreamer.conf with correct IP and pks path. I have created a new index associated to the eStreamer2 app so I can search logs related to a specific DC. The index looks into $SPLUNK_HOME/etc/apps/eStreamer2/log folder for logs. I changed the index field in default/inputs.conf with the name of the index created before, changed the path on monitor section and left everything else the same. I changed the paths in default/indexes.conf to match newly created index name. I changed definition field in default/macros.conf to match newly created index name. I start the client by running estreamer_client.pl -c /opt/splunk/etc/apps/eStreamer2/local/estreamer.conf command. I see logs flowing in the CLI but nothing is populating the $SPLUNK_HOME/etc/apps/eStreamer2/log folder therefore logs are not indexed. What did I forget ? Where do you specify to the script the path to put logs in ? Regards, ... View more