All Apps and Add-ons

eStreamer Logs Not Appearing in $SPLUNK_HOME/etc/apps/eStreamer/log/

mrdev10
New Member

eStreamer logs are not populating. it was working then one day it stopped. any ideas?

0 Karma

rafeeqsid25
New Member

https://splunkbase.splunk.com/app/3662/ and https://splunkbase.splunk.com/app/3663/ are not supported on Splunk Windows Environment.

0 Karma

douglashurd
Builder

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

0 Karma

paduka
Path Finder

Hi,

I am also facing the same issue. All of a sudden the logs aren't getting populated.

What all settings shall I validate?

Thanks!

0 Karma

douglashurd
Builder

do you still have the problem? What version of Firepower are you using?

0 Karma

rtoloczk
Explorer

I am having this problem.

My $SPLUNK_HOME/etc/apps/eStreamer/log/ directory had filled up and stopped Splunk from functioning. I cleared out the log directory and restarted splunk, but now eStreamer is not functioning at all. There are no logs and no new data in Splunk. The client is reporting that it is running just fine.

I also upgraded to 2.2.2 with no change.

We are running version 5.4.1 of Defense Center.

It was working fine before the log directory filled up.

0 Karma

rtoloczk
Explorer

Not sure what happened. I moved the "old" app to /disabled_apps, installed 2.2.2 from scratch and configured just like the old one was and everything is working just fine now.

Now I just need to make sure that the log cleaning configuration is in place

0 Karma
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...