Dear all I have an issue with a new dedicated Search Head for ES. My Splunk architecture is quite simple. 4 clustered indexers, 3 SH, and 1 dedicated SH for ES everything is working fine, except the ES notable events : the index notable remains empty. In the SH, search peer list : everything is OK, indexers are defined All the events of the SH are sent to the indexers, the notable index has been created there I have correlation searches active with 2 actions : notable and json alerting. - JSON alerting is OK - notable : not OK If I manually create a notable event on ES, I can see it in the index main, with a strange sourcetype (“stash_common_action_model-too_small”) I have found it with the following request “index=main notable” “1589789135, search_name="Manual Notable Event - Rule", _time="1589789135", app="SplunkEnterpriseSecuritySuite", creator="XXXX", info_max_time="+Infinity", info_min_time="0.000", info_search_time="1589789135.348247000", owner="XXXX", rule_description="hello world", rule_title="test5", security_domain="access", status="1", urgency="informational" => is there an issue with this sourcetype / index ? => or any idea for troubleshooting ? thank you in advance PS: a Splunk ticket was opened 10 days ago ... but I am still stuck ... View more

Dear community I am trying to onboard the logs from my Cisco FMC (v6.4.0.7) to Splunk (7.3.3), using the app Cisco Firepower eStreamer eNcore (3.6.8) the connectivity is OK, I am able to collect some logs during a few minutes. and then the estreamer process stopped/failed. after 15/30 minutes the process is able again to collect some data events from the IDS ... and then fails again I don't really know where/what troubleshoot. maybe the default setting "maxQueueSize": 100. this one can be increased as we have a lot of events. thank you so much Message output for index=estreamer sourcetype="cisco:estreamer:log" : Starting process. Starting process. Starting process. Starting Monitor. Using TLS v1.2 Connecting to x.x.x.x:8302 Connection successful Streaming info response Response message=xxxxx Receiving response message Sending request message Request message=0001000200000008ffffffff48900061 Creating request message Using TLS v1.2 Connecting to xxxxx:8302 Creating connection Check certificate Settings: xxxxxxxx= Processes: 4 Sha256: 3xxxxx Platform version: Linux-3.10.0-1062.el7.x86_64-x86_64-with-redhat-7.7-Maipo 2020-03-10 11:14:28,556 Controller INFO Starting client (pid=25963). eNcore version: 3.6.8 Goodbye Stopping Monitor. Process 20330 (Process-4) exit code: 0 Exiting Error state. Clearing queue Stop message received Process 20329 (Process-3) exit code: 0 Exiting Error state. Clearing queue Stop message received Process 20328 (Process-2) exit code: 0 Exiting Error state. Clearing queue Stop message received Process 20327 (Process-1) exit code: 1 Stopping... Running. 0 handled; average rate 0 ev/sec; Process subscriberParser is dead. Starting. 0 handled; average rate 0 ev/sec; Starting process. Starting process. Starting process. Starting Monitor. ... View more