All Apps and Add-ons

Status of eStreamer client inconsistent, despite client continuing to run

reswob4
Builder

(This seems to be the only way to get tech support the this app)

I recently upgraded to version 2.2.2 of the Cisco eStreamer for Splunk. While everything is working and events are being collected, the eStreamer Client Status on the main dashboard flips between 'Running' and 'Disabled'. This, of course, confuses management.

When you look at Help - Client Status, you get a dashboard of all the status updates and you can indeed see that the status oscillates. But when I tail the debug log in the app, the only thing it shows is that it's reading or waiting for logs. And when you check the running processes for the app, that process always is running.

So why does the Client Status keep changing?

0 Karma

douglashurd
Builder

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

0 Karma

douglashurd
Builder

What version of Firepower are you using? If you on 6.x then a new and vastly improved Add-on will be available in about a month with a beta available next week if you're interested.

Doug

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...