Hi, Try following steps to clear out the memory so FMC logs start to flow again: Go to: /opt/splunk/etc/apps/TA-eStreamer/bin/encore Remove "A.A.A.A-8302_proc.pid" $ ps aux | grep estreamer pkill -9 -f service.py Restart Splunk services I hope it helps! With Regards ... View more

Hi, Actually I've installed the new released version (4.2.2) and only changed the monitor stanza to monitor the right path: [monitor://$SPLUNK_HOME/etc/apps/TA-eStreamer/bin/encore/data/splunk] the new version is working well now, except the clean stanza, which even changing the path doesn't seem to work. I also reduced the time to +10 minutes, but still no joy: clean() { # Delete data older than 12 hours -> 720mins # find ../../data -type f -mmin +720 -delete # correcting path to new path in new version 4.2.2 of TA find $SPLUNK_HOME/etc/apps/TA-eStreamer/bin/encore/data/splunk -type f -mmin +10 -delete } I'm wondering if there is any recommended work around to fix this. Thank you in advance. ... View more

Thank you @richgalloway !  --- Is there any reference available from Splunk documentation to address this? ... View more

Apparently there is a new version of eStreamer available (4.2.0).. wondering if anyone used that version? I'm using 4.0.9 and it stops working every 2, 3 days. when I run the status command below:  /opt/splunk/etc/apps/TA-eStreamer/bin/splencore.sh status getting this error: Traceback (most recent call last): File "./estreamer/configure.py", line 38, in <module> import estreamer.common.convert as convert File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/__init__.py", line 28, in <module> from estreamer.connection import Connection File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/connection.py", line 23, in <module> import ssl File "/opt/splunk/lib/python3.7/ssl.py", line 98, in <module> import _ssl # if we can't import it, let the error propagate ImportError: libssl.so.1.0.0: cannot open shared object file: No such file or directory   any recommendation to solve this? 🙂 ... View more