All Apps and Add-ons

Cisco eStreamer eNcore 4.6.0 Add-on for Splunk 8.2.0 "i am legend" on setup page

splunk219783
Path Finder

After upgrading to 8.2.0 we needed to upgrade eStreamer to a version that supports 8.2, the old 3.8.x version no longer worked.

I've been struggling for 4.6.0 for weeks now.  I can't get it to work at all.  When I go to the overview page its blank, when I force myself to the setup URL i just get a "i am legend" message with no ability to configure inputs like I used to.

Launch App button, totally blank page (http://splunk/en-US/app/TA-eStreamer/info_overview)

No setup button anymore, but forced via old url (http://splunk/en-US/manager/TA-eStreamer/apps/local/TA-eStreamer/setup?action=edit)

 

I Am legend.png

spencore.sh test works just fine:

-bash-4.2$ /opt/splunk/etc/apps/TA-eStreamer/bin/splencore.sh test
2021-06-30T14:10:31.395618 Diagnostics INFO Checking that configFilepath (estreamer.conf) exists
2021-06-30 14:10:31,414 Diagnostics INFO Check certificate
2021-06-30 14:10:31,414 Diagnostics INFO Creating connection
2021-06-30 14:10:31,415 Connection INFO Connecting to 1.2.3.4:8302
2021-06-30 14:10:31,415 Connection INFO Using TLS v1.2
2021-06-30 14:10:31,569 Diagnostics INFO Creating request message
2021-06-30 14:10:31,570 Diagnostics INFO Request message=b'0001000200000008ffffffff48900061'
2021-06-30 14:10:31,570 Diagnostics INFO Sending request message
2021-06-30 14:10:31,570 Diagnostics INFO Receiving response message
2021-06-30 14:10:31,581 Diagnostics INFO Response message=b'gAN9cQAoWAcAAAB2ZXJzaW9ucQFLAVgLAAAAbWVzc2FnZVR5cGVxAk0DCFgGAAAAbGVuZ3RocQNLMFgEAAAAZGF0YXEEQzAAABOBBBBBBBBBBBBTiABBBBBBBBBBBBGgsAAAAIAAAAAAAAAABxBXUu'
2021-06-30 14:10:31,581 Diagnostics INFO Streaming info response
2021-06-30 14:10:31,581 Diagnostics INFO Connection successful

I followed this guide, i'm on the last step where i need ot check "is enabled" but cannot since the setup page wont load. 

https://www.cisco.com/c/en/us/td/docs/security/firepower/670/api/eStreamer_enCore/eStreamereNcoreSpl...

Labels (2)
0 Karma

star_lord
Explorer

I ran into this same issue on Splunk 8.0.10 and Cisco eStreamer eNcore 4.8.3 Add-on.  The solution for me was to move the setup.xml from the bin folder to the default folder.

mv /opt/splunk/etc/apps/TA-eStreamer/bin/setup.xml /opt/splunk/etc/apps/TA-eStreamer/default/

 

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...