topic Re: Cisco eStreamer eNcore Add-on for Splunk: Does anybody have core Python code running on the Windows servers? in All Apps and Add-ons

Cisco eStreamer eNcore Add-on for Splunk: Does anybody have core Python code running on the Windows servers?

oagtexas — Thu, 23 Aug 2018 20:29:16 GMT

Yes, I read the documentation but "not supported" is often different than "doesn't work". Anybody have this working on Windows before I spend too much time on it? Any tweaks or anything to make this work?

Re: Cisco eStreamer eNcore Add-on for Splunk: Does anybody have core Python code running on the Windows servers?

mstjohn_splunk — Thu, 23 Aug 2018 21:17:58 GMT

Hi @oagtexas! In general, your question has a greater chance of being answered by experts in the Answers community when when you provide as much information and context as possible. Thanks.

Re: Cisco eStreamer eNcore Add-on for Splunk: Does anybody have core Python code running on the Windows servers?

sastrach — Fri, 24 Aug 2018 08:45:31 GMT

The core python code definitely works on Windows, but what won't work is the wrapper shell scripts for Splunk - splencore.sh and configure.sh.

splencore.sh is used by the data input which keeps it running
configure.sh is used by the configuration screen

If you were prepared to configure it manually, you could ignore configure.sh. Then you'd just need to workaround splencore.sh - either powershell or python might be a sensible starting point.

It you really wanted to take this further, then you may wish to consider using the command line version instead (https://community.cisco.com and search for “eNcoreCLI” or contact the Cisco Technical Alliance crew). You would still have work to do. It's not built to run as a windows service and you'd need to bypass encore.sh but it's possible to run directly in python from the command line. The other thing that's not ideal in windows is that it doesn't have a clean way of handling SIGs like Linux - but there's even some code in there (search windows.py) which listens for enter key press events.

Good luck!

Re: Cisco eStreamer eNcore Add-on for Splunk: Does anybody have core Python code running on the Windows servers?

douglashurd — Fri, 24 Aug 2018 17:29:11 GMT

This is not supported on Windows, Yet. There will be a developer working on it at the end of the year. I cannot commit to a date yet until it's scoped and know what's involved in getting past the outstanding issues.

Re: Cisco eStreamer eNcore Add-on for Splunk: Does anybody have core Python code running on the Windows servers?

oagtexas — Tue, 28 Aug 2018 15:08:26 GMT

Thanks for this. Very helpful.

Re: Cisco eStreamer eNcore Add-on for Splunk: Does anybody have core Python code running on the Windows servers?

oagtexas — Tue, 28 Aug 2018 15:08:51 GMT

Thanks for the update!

Re: Cisco eStreamer eNcore Add-on for Splunk: Does anybody have core Python code running on the Windows servers?

awillcox — Thu, 04 Nov 2021 22:47:40 GMT

Hello from the future. I have time traveled back to 2018 to see if there are still any plans to port this to Windows. Not my choice, I am in a Windows only shop.