All Apps and Add-ons

Cisco eStreamer eNcore 4.6.0 Add-on for Splunk 8.2.0 "i am legend" on setup page

splunk219783
Path Finder

After upgrading to 8.2.0 we needed to upgrade eStreamer to a version that supports 8.2, the old 3.8.x version no longer worked.

I've been struggling for 4.6.0 for weeks now.  I can't get it to work at all.  When I go to the overview page its blank, when I force myself to the setup URL i just get a "i am legend" message with no ability to configure inputs like I used to.

Launch App button, totally blank page (http://splunk/en-US/app/TA-eStreamer/info_overview)

No setup button anymore, but forced via old url (http://splunk/en-US/manager/TA-eStreamer/apps/local/TA-eStreamer/setup?action=edit)

 

I Am legend.png

spencore.sh test works just fine:

-bash-4.2$ /opt/splunk/etc/apps/TA-eStreamer/bin/splencore.sh test
2021-06-30T14:10:31.395618 Diagnostics INFO Checking that configFilepath (estreamer.conf) exists
2021-06-30 14:10:31,414 Diagnostics INFO Check certificate
2021-06-30 14:10:31,414 Diagnostics INFO Creating connection
2021-06-30 14:10:31,415 Connection INFO Connecting to 1.2.3.4:8302
2021-06-30 14:10:31,415 Connection INFO Using TLS v1.2
2021-06-30 14:10:31,569 Diagnostics INFO Creating request message
2021-06-30 14:10:31,570 Diagnostics INFO Request message=b'0001000200000008ffffffff48900061'
2021-06-30 14:10:31,570 Diagnostics INFO Sending request message
2021-06-30 14:10:31,570 Diagnostics INFO Receiving response message
2021-06-30 14:10:31,581 Diagnostics INFO Response message=b'gAN9cQAoWAcAAAB2ZXJzaW9ucQFLAVgLAAAAbWVzc2FnZVR5cGVxAk0DCFgGAAAAbGVuZ3RocQNLMFgEAAAAZGF0YXEEQzAAABOBBBBBBBBBBBBTiABBBBBBBBBBBBGgsAAAAIAAAAAAAAAABxBXUu'
2021-06-30 14:10:31,581 Diagnostics INFO Streaming info response
2021-06-30 14:10:31,581 Diagnostics INFO Connection successful

I followed this guide, i'm on the last step where i need ot check "is enabled" but cannot since the setup page wont load. 

https://www.cisco.com/c/en/us/td/docs/security/firepower/670/api/eStreamer_enCore/eStreamereNcoreSpl...

Labels (2)
0 Karma

star_lord
Explorer

I ran into this same issue on Splunk 8.0.10 and Cisco eStreamer eNcore 4.8.3 Add-on.  The solution for me was to move the setup.xml from the bin folder to the default folder.

mv /opt/splunk/etc/apps/TA-eStreamer/bin/setup.xml /opt/splunk/etc/apps/TA-eStreamer/default/

 

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...