Why isn't the Cisco eStreamer for Splunk app not polling Connection/RNA data?

[jthoel]

We have the FMC set to send connection events, and they are turned on in the Access Policies (set to just send to the FMC, not syslog) and when we first started up eStreamer, we got a large burst of events, but then they seemed to stop.

If I look in the _app_path_/log/ directory, I see a large number of estreamer.log.timestamp files. Are those supposed to be imported into the system by the .pl that runs?

[douglashurd]

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

[tommyblanchard]

Yes, I think we are having the same issue. The Connection Events data (in splunk it's labeled as rec_type_simple=RNA) are coming over sporadically.

The other types of data coming over through eStreamer seem to be coming over constantly, but the RNA data is on and off.

Anyone have any ideas to try?

[carlospalm]

check the field rec_type_category=RNA