About dragonchen

dragonchen · ‎11-29-2020

Hi, I have configured eStreamer according to cisco official guide, but there are no message to splunk and error message below Can someone help resolve the issue, Thanks https://www.cisco.com/c/en/us/td/docs/security/firepower/670/api/eStreamer_enCore/eStreamereNcoreSplunkOperationsGuide_409.html ./splencore.sh test show message below

dragonchen · ‎07-19-2020

Hi I have find the answer, you can create more then 1 SQS-based-s3 input to get message fsater, 1 input get 10message/second, 10 input get 100message/second. I have created 20 input and it work find.

dragonchen · ‎07-15-2020

I have also try to edit {splunk_home}/etc/apps/Splunk_TA_aws/bin/aws_sqs_based_s3_inputs_rh.py's sqs_batch_size limitation and {splunk_home}/etc/apps/Splunk_TA_aws/local/inputs.conf 's sqs_batch_size, but it is not working

dragonchen · ‎07-15-2020

Hi I have configured SQS-Based S3 Input to get cloudtrail log, but the SQS Batch Size is limited to 1 to 10. I have also configre Interval (in seconds) to zero. But my queue is also growing. Can I break the limitation or other approach to get cloudtrail log in s3? I am using the architect below (I have more then one hundred account) Thanks

Posts	4
Solutions	0
Karma Given	0
Karma Received	0
Member Since	‎07-15-2020

Online Status	Offline
Date Last Visited	‎11-30-2020 11:24 PM

Cisco eStreamer eNcore for Splunk TA-eStreamer req...

Splunk Add-on for AWS for cloudtrail SQS-Based S3 ...

Cisco eStreamer eNcore for Splunk TA-eStreamer req...

Re: Splunk Add-on for AWS for cloudtrail SQS-Based...

Re: Splunk Add-on for AWS for cloudtrail SQS-Based...

Splunk Add-on for AWS for cloudtrail SQS-Based S3 ...