hello,
in my testing env, I have installed streamer encore addon, firesight addon and ES.
and I have configured the eStreamer and its working good. and renamed the sourcetype from cisco:estreamer:data to Cisco:Sourcefire
this should make the data from the firesight device to work and to fill ES dashboards, but there is only one dashboard is working which is intrusion center, on other dashboards I find out the Splunk don't apply the alises(lookups).csv files on the events and this is why it don't fill the dashboards.
so how to fix it or troubleshoot the issue id depth
↧
