Unable to receive intrusion event packet data field > 4k from FMC into splunk using Cisco security cloud integration

[yssplunker]

Hi All,

As old estreamer add -on is replaced by new app Cisco security cloud ( https://splunkbase.splunk.com/app/7404) , we have installed new app and testing in distributed environment. We are facing one issue with intrusion event packet logs which are streaming from FMC into splunk. Whenever "packet data" field in intrusion event packets greater than 4k bytes, it is missing in splunk logs.Only packetdata field is missing, remaining complete log is visible in splunk. And there are no errors related to parsing, truncating issues in splunk _internal index.

Does anyone has faced the same issue or any fix for this?

[livehybrid]

Hi @yssplunker 

Please could you confirm the sourcetype of your data? Looking in the app, most of the sourcetypes have TRUNCATE=0 which means they shouldnt be truncated, although not all of them!

Please let me know which sourcetype you are having with and I'll check that specifically.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[yssplunker]

Sourcetype is "cisco:sfw:estreamer" and i am using with default app settings .