Thank you for the inputs. I checked and this is not the root cause. I need to identify the root cause to prevent such cases happening in the future. ... View more

Hi, Try following steps to clear out the memory so FMC logs start to flow again: Go to: /opt/splunk/etc/apps/TA-eStreamer/bin/encore Remove "A.A.A.A-8302_proc.pid" $ ps aux | grep estreamer pkill -9 -f service.py Restart Splunk services I hope it helps! With Regards ... View more

Hi, Actually I've installed the new released version (4.2.2) and only changed the monitor stanza to monitor the right path: [monitor://$SPLUNK_HOME/etc/apps/TA-eStreamer/bin/encore/data/splunk] the new version is working well now, except the clean stanza, which even changing the path doesn't seem to work. I also reduced the time to +10 minutes, but still no joy: clean() { # Delete data older than 12 hours -> 720mins # find ../../data -type f -mmin +720 -delete # correcting path to new path in new version 4.2.2 of TA find $SPLUNK_HOME/etc/apps/TA-eStreamer/bin/encore/data/splunk -type f -mmin +10 -delete } I'm wondering if there is any recommended work around to fix this. Thank you in advance. ... View more

Thank you @richgalloway !  --- Is there any reference available from Splunk documentation to address this? ... View more

Apparently there is a new version of eStreamer available (4.2.0).. wondering if anyone used that version? I'm using 4.0.9 and it stops working every 2, 3 days. when I run the status command below:  /opt/splunk/etc/apps/TA-eStreamer/bin/splencore.sh status getting this error: Traceback (most recent call last): File "./estreamer/configure.py", line 38, in <module> import estreamer.common.convert as convert File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/__init__.py", line 28, in <module> from estreamer.connection import Connection File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/connection.py", line 23, in <module> import ssl File "/opt/splunk/lib/python3.7/ssl.py", line 98, in <module> import _ssl # if we can't import it, let the error propagate ImportError: libssl.so.1.0.0: cannot open shared object file: No such file or directory   any recommendation to solve this? 🙂 ... View more