All Apps and Add-ons

Cisco eStreamer App in Splunk doesn't get Flow logs

gaddams
Explorer

I have installed Cisco eStreamer app in Splunk and configured to get data from Sourcefire defense center. I am able to see different logs in the eStreamer App dashboard but the Flow logs are "0". I don't see and flow logs.
Could you let me know if there is any additional setting that I need to configure on the Sourcefire or on the Splunk app?

Thanks
Swetha

0 Karma
1 Solution

cgrady_sf
Path Finder

Be sure you enable the "Discovery Events" from the System > Local > Registration page on the Defense Center. That is where the flow logs are enabled in eStreamer. Additionally, you will need to enable connection logging in your Access Control policy.

I apologize for not responding earlier -- I've been out of town on business.

Thanks for your interest in eStreamer for Splunk.

Colin Grady

View solution in original post

gaddams
Explorer

Thanks Colin. This worked! We are able to see the flow logs in Splunk.

Thanks
Swetha

0 Karma

cgrady_sf
Path Finder

Be sure you enable the "Discovery Events" from the System > Local > Registration page on the Defense Center. That is where the flow logs are enabled in eStreamer. Additionally, you will need to enable connection logging in your Access Control policy.

I apologize for not responding earlier -- I've been out of town on business.

Thanks for your interest in eStreamer for Splunk.

Colin Grady

kheli
Path Finder

Will this also support Host Discovery events? Thank you.

0 Karma

gaddams
Explorer

Thanks Colin. This worked. We are able to see flow logs in Splunk.

Thanks
Swetha

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...