Thanks Joe, You are right, using an estreamer.conf will override the default.conf and that is a normal practice we see with our customers who use encore.  I wanted to take an opportunity to share with everyone the latest documentation we recently published, it not only provides a complete walkthrough on the install, but it also contains a detailed Q&A section that highlights some the issues that are mentioned here   https://www.cisco.com/c/en/us/td/docs/security/firepower/70/api/eNcore/eNcore_Operations_Guide_v08.html   As always if there is an issue we regularly monitor the encore community mailer, encore-community@cisco.com. so feel free to post questions there, thanks again ... View more

Hi, versions 2 and later have the mappings in the TA (https://splunkbase.splunk.com/app/4221/) as described in this thread. Is there some other issue you are seeing? ... View more

Hi, The NVMCollector is only compiled for 64bit Linux. So to run the collector you would need a 64bit Linux system or you would need to host Linux on your Windows box (VM, Windows:containers, etc.) Does that clarify it? ... View more

Hi, The NVMCollector is a 64bit Linux solution. Collector installation is described in en-US/app/CiscoNVM/Install We have never tried using Linux Subsystem for Windows and an Ubuntu instance, but you could certainly explore that if you want to. It would not be officially supported. Also, since the NVMCollector runs in Docker, you can explore using Docker on Windows-10. https://docs.microsoft.com/en-us/virtualization/windowscontainers/deploy-containers/linux-containers Again, not officially supported deployment option, but an avenue to explore. Please let us know how it works out. ... View more

Let us know what you think of the new 2.x version ... View more

This will be addressed shortly in version 2.0 which has a number of new and exciting enhancements. ... View more

Please confirm that your NVM client is configured to send flows directly to your collector (and not forwarded through some intermediate device). In your Splunk instance, do you see the raw data getting indexed? (From any report, click the magnifying glass to goto raw search) ... View more

Hi, The collector does not support multiple syslog destinations at this time. You could use a UDP replicator such as http://code.google.com/p/samplicator/ to achieve this. ... View more

We are looking into that for a follow-on release. ... View more

Hi, Send an email directly to nvzflow@cisco.com and we can chat about it directly. ... View more

Hi, Splunk is an amazing tool as you note. NVM will remain as a separate offering from those other tools. ... View more

Hi, There are a few things you need to do. AnyConnect: Configure NVM Profile. Configure TND setting in VPN profile. The client will only send IPFIX (nvzFlow) when it has determined that it is on a trusted network. Install and configure the Splunk App. In the install directory is the IPFIX(nvzFlow)-to-syslog component, that you need to manually install on a Linux 64 bit system. Reboot the AnyConnect client after completing both steps and verify with a tool such as Wireshark, that you are seeing IPFIX(nvzFlow) packets leaving the device on the configured port. ... View more