I lost action field in the firewall rule logging cisco:estreamer:data. There is a field called fw_rule_action but there is supposed to be an autolookup that translates the fw_rule_action to action.  I am using 4.6.0 but I downloaded and check 4.6.1 and 4.6.2 and all of them have the line for the autolookup commented out. I have emailed encore-community@cisco.com for further support.    Thanks! ... View more

Will try that. I don't believe we have access to the 4.6.1 version of the TA yet. Doesn't look like it's published to splunkbase. ... View more

@douglashurd @vik_splunk  I've switched back to my old HF and its been very stable. FMC Ubuntu Splunk estreamer TA customizations if any Status 6.6.4 18.04.5 LTS 7.2.10 3.6.8 default sourcetype Stable     ... View more

FMC Ubuntu Splunk estreamer TA customizations if any Status 6.6.4 20.04.2 LTS 8.2 4.6.0 default sourcetype Intermittent   I have to stop the estreamer service and start it back up to get it going at least once every day or 2 days. When that doesn't work I have to reboot the whole server. ... View more

Same here, happening to me on a daily basis  ... View more

Hi @douglashurd , I am also seeing the same issue with the latest TA on Splunk 8.2. Seems like it happens every day or every other day I get the same error and it stops pulling logs. 2021-06-21 08:10:12,573 Monitor INFO Running. 62720000 handled; average rate 1371.82 ev/sec; 2021-06-21 08:12:11,573 Monitor INFO Running. 62860500 handled; average rate 1371.3 ev/sec; 2021-06-21 08:14:11,827 Monitor INFO Running. 63002100 handled; average rate 1370.8 ev/sec; 2021-06-21 08:16:12,215 Monitor INFO Running. 63148100 handled; average rate 1370.4 ev/sec; 2021-06-21 08:16:43,508 Service ERROR [no message or attrs]: Invalid JSON in settings file ... View more