11-06-2019 07:37 AM - edited 02-21-2020 09:40 AM
Hi all,
-Cisco Firepower App for Splunk version 1.3.7
-Cisco eStreamer eNcore for Splunk version 3.6.5
We've successfully setup estreamer between Splunk and our FMC, when I search in the Splunk events for
sourcetype="cisco:estreamer:data", I see thousands of recent events (last 24 hours = 260416 events)
However, when I go to the Cisco firepower app for Splunk, all dashboards display "No results found".
I went over the documentation a few times, but as far as I can see, we did everything correctly.
Does anyone have an idea why the app doesn't seem to see/process the estreamer events?
Best regards,
Joeri
11-14-2019 07:42 AM
Hi Joeri-
A couple of questions:
Thank you for rating helpful posts!
09-07-2020 07:50 PM
I too am facing the exact same issue. Followed all the steps in the guide and while eStreamer app shows data but nothing in the firepower app. Anyone else have any luck getting this working?
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide