Cisco eStreamer for Splunk: How to log "Discovery Events"?

[splunk_cv]

Good morning,

i have a working installation of the app on a Splunk distribuited environment, but i have this problem:

according to Cisco's guide i have to check "Discovery Events" to transmit host discovery events. So i checked "Discovery Events" in System->Local->Registration.

I can see events in VDC in the tab Analysis->Host->Discovery Events, but i can't find the log for those events in Splunk.

Are there other configurations or other things to check? Or maybe i have a wrong idea about Discovery Event?

Thank in advance

[cgrady_sf]

Hello,

Unfortunately discovery events, such as those for hosts and users, are not currently supported. The need for the Discovery Events checkbox to be checked is to allow for the connection events to come across via eStreamer. This actually changed in 5.4, where there is now a dedicated checkbox for connection events. With 5.4, the Discovery Events checkbox can be disabled and there should be no change to the processed events available in Splunk.

Hope this helps answer your question.
Colin