All Apps and Add-ons

Cisco eStreamer eNcore 4.6.0 Add-on for Splunk 8.2.0 "i am legend" on setup page

splunk219783
Path Finder

After upgrading to 8.2.0 we needed to upgrade eStreamer to a version that supports 8.2, the old 3.8.x version no longer worked.

I've been struggling for 4.6.0 for weeks now.  I can't get it to work at all.  When I go to the overview page its blank, when I force myself to the setup URL i just get a "i am legend" message with no ability to configure inputs like I used to.

Launch App button, totally blank page (http://splunk/en-US/app/TA-eStreamer/info_overview)

No setup button anymore, but forced via old url (http://splunk/en-US/manager/TA-eStreamer/apps/local/TA-eStreamer/setup?action=edit)

 

I Am legend.png

spencore.sh test works just fine:

-bash-4.2$ /opt/splunk/etc/apps/TA-eStreamer/bin/splencore.sh test
2021-06-30T14:10:31.395618 Diagnostics INFO Checking that configFilepath (estreamer.conf) exists
2021-06-30 14:10:31,414 Diagnostics INFO Check certificate
2021-06-30 14:10:31,414 Diagnostics INFO Creating connection
2021-06-30 14:10:31,415 Connection INFO Connecting to 1.2.3.4:8302
2021-06-30 14:10:31,415 Connection INFO Using TLS v1.2
2021-06-30 14:10:31,569 Diagnostics INFO Creating request message
2021-06-30 14:10:31,570 Diagnostics INFO Request message=b'0001000200000008ffffffff48900061'
2021-06-30 14:10:31,570 Diagnostics INFO Sending request message
2021-06-30 14:10:31,570 Diagnostics INFO Receiving response message
2021-06-30 14:10:31,581 Diagnostics INFO Response message=b'gAN9cQAoWAcAAAB2ZXJzaW9ucQFLAVgLAAAAbWVzc2FnZVR5cGVxAk0DCFgGAAAAbGVuZ3RocQNLMFgEAAAAZGF0YXEEQzAAABOBBBBBBBBBBBBTiABBBBBBBBBBBBGgsAAAAIAAAAAAAAAABxBXUu'
2021-06-30 14:10:31,581 Diagnostics INFO Streaming info response
2021-06-30 14:10:31,581 Diagnostics INFO Connection successful

I followed this guide, i'm on the last step where i need ot check "is enabled" but cannot since the setup page wont load. 

https://www.cisco.com/c/en/us/td/docs/security/firepower/670/api/eStreamer_enCore/eStreamereNcoreSpl...

Labels (2)
0 Karma

star_lord
Explorer

I ran into this same issue on Splunk 8.0.10 and Cisco eStreamer eNcore 4.8.3 Add-on.  The solution for me was to move the setup.xml from the bin folder to the default folder.

mv /opt/splunk/etc/apps/TA-eStreamer/bin/setup.xml /opt/splunk/etc/apps/TA-eStreamer/default/

 

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...