All Apps and Add-ons

Why isn't the Cisco eStreamer for Splunk app not polling Connection/RNA data?

jthoel
New Member

We have the FMC set to send connection events, and they are turned on in the Access Policies (set to just send to the FMC, not syslog) and when we first started up eStreamer, we got a large burst of events, but then they seemed to stop.

If I look in the _app_path_/log/ directory, I see a large number of estreamer.log.timestamp files. Are those supposed to be imported into the system by the .pl that runs?

0 Karma

douglashurd
Builder

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

0 Karma

tommyblanchard
New Member

Yes, I think we are having the same issue. The Connection Events data (in splunk it's labeled as rec_type_simple=RNA) are coming over sporadically.

The other types of data coming over through eStreamer seem to be coming over constantly, but the RNA data is on and off.

Anyone have any ideas to try?

0 Karma

carlospalm
New Member

check the field rec_type_category=RNA

0 Karma
Get Updates on the Splunk Community!

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

Investigate Security and Threat Detection with VirusTotal and Splunk Integration

As security threats and their complexities surge, security analysts deal with increased challenges and ...