the configuration went pretty good and I could get a successful connection to the eStreamer.
As I wanted to search for sourcetype="cisco:estreamer:data" there were no data coming in. I can prove that a lot of data is sent to Splunk with the command:
tcpdump port 8302
Once I'm looking for index=_internal estreamer (log_level=ERROR OR log_level=WARN) there are a lot of error message like this:
ERROR [604f2bfe5a7f42306d1990] appnav:186 - Unable to parse nav XML for app=eStreamer-Dashboard; Unicode strings with encoding declaration are not supported. Please use bytes input or XML fragments without declaration.
Could someone please help me, I don't have any idea why I'm getting this error...