Installed and configured Cisco Estreamer Encore add on for Splunk (3.5.8) both on the Firepower FMC and on my Splunk heavy forwarder (Splunk v 7.2.7). I can get estreamer-status and estreamer-logs to come into Splunk but not estreamer-data (the most important piece). After I configure eStreamer add on I keep getting the following error : "EncoreException : unable to read password from console." If a look a little deeper I find "Unable to process pkcs12 file".
I have deleted and remade the FMC certificate 6 or 7 times. I have given it a password, and not given it a password. The result is the same. Does anyone have a similar problem or better yet a good solution for this?
↧