We are using the CiscoSecurityCloud TA 3.6.7 to ingest firewall events via eStreamer from a single FMC that has 5 firewall groups connected to it. We cannot separate these groups across multiple FMC instances as they are all managed by one FMC. Event types we collect are ConnectionEvent, IntrusionEvent, and FileEvent, with import_time_range set to from_now. The ingestion is consistently falling behind real-time, and the delay grows with log volume. During peak traffic hours the lag reaches several hours. We already verified the eStreamer TCP connection to FMC is stable with no disconnects or SSL errors, and the delay is directly correlated with traffic volume — low traffic gives around 40 minutes delay while high traffic pushes it to several hours. Our questions are: Is this a known limitation when a single FMC manages multiple high-traffic firewall groups over one eStreamer connection? Are there any tuning options in CiscoSecurityCloud TA 3.6.7 to improve throughput such as chunk size or socket buffer settings? And is there any recommended workaround for this scenario where splitting the FMC is not an option? Any guidance from the community or Cisco/Splunk engineers would be greatly appreciated. Cisco Security Cloud ... View more

Hi everyone, I am trying to configure Kaspersky Security Center to forward logs to Splunk using Syslog over TLS. However, I need some guidance on the following points:   How can I configure Kaspersky Security Center to send logs via Syslog over TLS? What are the steps to generate the necessary certificates for this setup? Which certificate formats or file extensions does Kaspersky Security Center accept for TLS encryption? Are there any specific configurations required on the Splunk side to properly receive and parse these logs over TLS? I would appreciate any insights, best practices, or documentation references that could help. Thank you in advance!   ... View more

Hello everyone, I'm currently collecting logs from a Fortigate WAF using Syslog, but I've encountered an issue where, after running smoothly for a while, the Splunk Heavy Forwarder (HF) suddenly stops receiving and forwarding the logs. The only way to resolve this is by restarting the HF, after which everything works fine again, but the problem eventually recurs. Could anyone advise on: Possible causes for this intermittent log collection issue Any specific configurations to keep the Syslog input stable Troubleshooting steps or recommended best practices to prevent having to restart the HF frequently Any insights or similar experiences would be much appreciated! Thank you! ... View more

Hi Splunk community,   I'm facing an issue with my Splunk deployment server, running on version 9.2.1 (splunk-9.2.1-78803f08aabb-linux-2.6-x86_64-manifest). I’ve added new configurations to the inputs.conf file for a WebLogic server within a specific deployment class. After making these changes, I pushed the configurations to the target WebLogic server and triggered a restart. Unfortunately, the new settings in the inputs.conf file are not being applied to the WebLogic server, even though the deployment server logs indicate that the service was successfully restarted. Has anyone experienced this issue or can offer advice on what might be causing the problem and how to resolve it? Thanks in advance! ... View more