Cisco eStreamer eNcore for Splunk -FMC forwarding logs to Splunk

Hi Pheniix, I setup eStreamer to forward logs to our Splunk instance; however, I am not receiving anything! .

"Intrusion Event Packet Data" is also checked.

We had several IPS event fires , since this configuration has been in place, but NOTHING was forwarded to Splunk. I did a search for

rec_type_simple=PACKET

and did not see anything :( . Could you please help me ?

2 comments

vip_member21

Jul 20, 2019Edited: Jul 20, 2019

Hi Anush, How are you doing?! :) Take a look at this amazing doc and check everything is set as it should be. If the issue still persists shout out at #Mike!

Google for  eStreamer eNcore for Splunk Operations Guide v3.5

(Because of copyright we are not allowed to post it here!)

anushkumar22

Jul 20, 2019

Hhah .Oh I will check it out! Thanks