All Apps and Add-ons

Cisco eStreamer eNcore 4.6.0 Add-on for Splunk 8.2.0 "i am legend" on setup page

splunk219783
Path Finder

After upgrading to 8.2.0 we needed to upgrade eStreamer to a version that supports 8.2, the old 3.8.x version no longer worked.

I've been struggling for 4.6.0 for weeks now.  I can't get it to work at all.  When I go to the overview page its blank, when I force myself to the setup URL i just get a "i am legend" message with no ability to configure inputs like I used to.

Launch App button, totally blank page (http://splunk/en-US/app/TA-eStreamer/info_overview)

No setup button anymore, but forced via old url (http://splunk/en-US/manager/TA-eStreamer/apps/local/TA-eStreamer/setup?action=edit)

 

I Am legend.png

spencore.sh test works just fine:

-bash-4.2$ /opt/splunk/etc/apps/TA-eStreamer/bin/splencore.sh test
2021-06-30T14:10:31.395618 Diagnostics INFO Checking that configFilepath (estreamer.conf) exists
2021-06-30 14:10:31,414 Diagnostics INFO Check certificate
2021-06-30 14:10:31,414 Diagnostics INFO Creating connection
2021-06-30 14:10:31,415 Connection INFO Connecting to 1.2.3.4:8302
2021-06-30 14:10:31,415 Connection INFO Using TLS v1.2
2021-06-30 14:10:31,569 Diagnostics INFO Creating request message
2021-06-30 14:10:31,570 Diagnostics INFO Request message=b'0001000200000008ffffffff48900061'
2021-06-30 14:10:31,570 Diagnostics INFO Sending request message
2021-06-30 14:10:31,570 Diagnostics INFO Receiving response message
2021-06-30 14:10:31,581 Diagnostics INFO Response message=b'gAN9cQAoWAcAAAB2ZXJzaW9ucQFLAVgLAAAAbWVzc2FnZVR5cGVxAk0DCFgGAAAAbGVuZ3RocQNLMFgEAAAAZGF0YXEEQzAAABOBBBBBBBBBBBBTiABBBBBBBBBBBBGgsAAAAIAAAAAAAAAABxBXUu'
2021-06-30 14:10:31,581 Diagnostics INFO Streaming info response
2021-06-30 14:10:31,581 Diagnostics INFO Connection successful

I followed this guide, i'm on the last step where i need ot check "is enabled" but cannot since the setup page wont load. 

https://www.cisco.com/c/en/us/td/docs/security/firepower/670/api/eStreamer_enCore/eStreamereNcoreSpl...

Labels (2)
0 Karma

star_lord
Loves-to-Learn

I ran into this same issue on Splunk 8.0.10 and Cisco eStreamer eNcore 4.8.3 Add-on.  The solution for me was to move the setup.xml from the bin folder to the default folder.

mv /opt/splunk/etc/apps/TA-eStreamer/bin/setup.xml /opt/splunk/etc/apps/TA-eStreamer/default/

 

0 Karma
Get Updates on the Splunk Community!

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...

Cloud Platform | Discontinuing support for TLS version 1.0 and 1.1

Overview Transport Layer Security (TLS) is a security communications protocol that lets two computers, ...

New Customer Testimonials

Enterprises of all sizes and across different industries are accelerating cloud adoption by migrating ...