All Apps and Add-ons

Estreamer for Splunk running but not getting streams

DomenicoFumarol
Explorer

Hi,
since a couple of days after our recent upgrade of SE to the latest release, Estreamer App for Splunk stopped to get streams from the FMC.
The app is showing as running but we get everywhere 0 as logs retrieved.
Client side checks look fine, but the messages file on the FMC is getting huge and that's all we see:

May 3 08:13:33 MY_FMC_SERVER SF-IMS[2823]: [2823] EventStreamer child(MY_CLIENT_IP):ConnectionHandler [ERROR] Error sending a message: Write Error
May 3 08:13:33 MY_FMC_SERVER SF-IMS[2823]: [2823] EventStreamer child(MY_CLIENT_IP):ConnectionHandler [ERROR] Error sending a message: Not connected
May 3 08:13:33 MY_FMC_SERVER SF-IMS[2823]: [2823] EventStreamer child(MY_CLIENT_IP):ConnectionHandler [ERROR] Error sending a message: Not connected
May 3 08:13:33 MY_FMC_SERVER SF-IMS[2823]: [2823] EventStreamer child(MY_CLIENT_IP):ConnectionHandler [ERROR] Error sending a message: Not connected
May 3 08:13:33 MY_FMC_SERVER SF-IMS[2823]: [2823] EventStreamer child(MY_CLIENT_IP):ConnectionHandler [ERROR] Error sending a message: Not connected

and then the service is generating an infinite number of "Error sending a message: Not connected" into messages log.
We tried to disable&re-enable the service via the Perl script manage_estreamer.pl, as well as to disable&re-enable the Estreamer client, but nothing changed. Same issue.

Did anyone meet this issue already?
Appreciate any help.

Thnak you.

0 Karma

douglashurd
Builder

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...