estreamer + Cisco Firepower App for Splunk : "no results found"

[Joeri4242]

Hi all,

-Cisco Firepower App for Splunk version 1.3.7

-Cisco eStreamer eNcore for Splunk version 3.6.5

We've successfully setup estreamer between Splunk and our FMC, when I search in the Splunk events for

sourcetype="cisco:estreamer:data", I see thousands of recent events (last 24 hours = 260416 events)

However, when I go to the Cisco firepower app for Splunk, all dashboards display "No results found".

I went over the documentation a few times, but as far as I can see, we did everything correctly.

Does anyone have an idea why the app doesn't seem to see/process the estreamer events?

Best regards,
Joeri

[nspasov]

Hi Joeri-

A couple of questions:

1. Which dashboard are you using? I ask this because there are two:
   • The older one (still supported):
     • https://splunkbase.splunk.com/app/3663/
   • The new one:
     • https://splunkbase.splunk.com/app/4388/
2. Have you followed all of the steps in the guide below:

• https://splunkbase.splunk.com/app/3662/#/details

Thank you for rating helpful posts!

[FirewallZia]

I too am facing the exact same issue. Followed all the steps in the guide and while eStreamer app shows data but nothing in the firepower app. Anyone else have any luck getting this working?