Splunk Enterprise Security

Do we need to upload missing estreamer logs to splunk or its automatic ?

utk123
Path Finder

My estreamer to device connection was down for sometime, so now I want to upload missing device logs to splunk.
I thought once the connection is established estreamer running on splunk will automatically pull missing logs from Device, but that's not happening.
I can follow steps listed on below link to upload missing logs to splunk, but not sure if the format would be same as the one pulled by estreamer?

http://docs.splunk.com/Documentation/SplunkLight/6.3.0/Gettingstarted/Uploadafile

0 Karma
1 Solution

lakshman239
SplunkTrust
SplunkTrust

if you are using eStreamer add-on, you can place the file in the $SPLUNK_HOME/etc/apps/TA-eStreamer/data, the add-on will read/parse and send it to required indexers correctly. [ assuming the format is same as the original ones]

View solution in original post

0 Karma

lakshman239
SplunkTrust
SplunkTrust

if you are using eStreamer add-on, you can place the file in the $SPLUNK_HOME/etc/apps/TA-eStreamer/data, the add-on will read/parse and send it to required indexers correctly. [ assuming the format is same as the original ones]

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...