I'm running into an issue with the Cisco eStreamer eNcore app where IPS events are very delayed getting to Splunk. I've setup a correlation rule on the FMC to email me when there is an IPS event. In Splunk I run a report every 30 minutes to search for IPS events past 4 hours from the estreamer host and email me the results. Based on the time I get the email from the FMC and when the events finally show up in the report it takes anywhere from 1.5 to 2 hours or more before triggered IPS events show up in Splunk. I've been working with Cisco TAC on this for a couple months and am no closer to solving . I've uninstalled Splunk and the TA-eStreamer App at least twice with the similar results. My version of Splunk, FMC, and eNcore app are as follows: Splunk - 7.2.7 (tried it on 7.3.0 as well) FMC - 6.4.0.4 Cisco eStreamer eNcore Add-on for Splunk - 3.6.8 (Same issue with older versions too) Is anyone else having this issue with eNcore? ... View more

I'm planning on moving the Enterprise Security app from one search head to another; search heads are not clustered. Has anyone done this that can give me the process that worked for you? ... View more

Hi All, We will be moving our physical indexers from one datacenter to another datacenter. The new datacenter will have a new IP address scheme so I'll need to re-IP the indexers after they're in the new datacenter. We have a multi-site index cluster, 2 sites with 2 indexers in each site. I will move one site at a time and during the move both indexers in that site will be unavailable; the other site will still be up and able to index though. The general plan I've come up with is as follows: 1.) On cluster master put cluster into maintenance mode 2.) Take peers in site offline * Do I want to disable splunk auto-start on boot? 3.) Power servers down 4.) Modify monitoring console assets.csv file changing old indexer IP to new indexer IP 5.) Modify cluster master distsearch.conf file changing old indexer IP to new indexer IP 6.) Move servers to new datacenter and power-on 7.) Change IP address on Indexer and verify connectivity to cluster master and search heads 8.) Start Splunk on indexers 9.) Verify re-connection with cluster master 10.) Verify logs are being indexed 11.) Verify search against indexers works 12.) Verify no errors in Splunk logs Am I missing any steps here? If you've done something similar and have pointers you'd like to share I would appreciate it. Thank you, Jon. ... View more