Cisco eStreamer eNcore Add-on for Splunk: Does anybody have core Python code running on the Windows servers?

[oagtexas]

Yes, I read the documentation but "not supported" is often different than "doesn't work". Anybody have this working on Windows before I spend too much time on it? Any tweaks or anything to make this work?

[douglashurd]

This is not supported on Windows, Yet. There will be a developer working on it at the end of the year. I cannot commit to a date yet until it's scoped and know what's involved in getting past the outstanding issues.

[awillcox]

Hello from the future.  I have time traveled back to 2018 to see if there are still any plans to port this to Windows.  Not my choice, I am in a Windows only shop.

[oagtexas]

Thanks for the update!

[sastrach · Accepted solution]

The core python code definitely works on Windows, but what won't work is the wrapper shell scripts for Splunk - splencore.sh and configure.sh.

• splencore.sh is used by the data input which keeps it running
• configure.sh is used by the configuration screen

If you were prepared to configure it manually, you could ignore configure.sh. Then you'd just need to workaround splencore.sh - either powershell or python might be a sensible starting point.

It you really wanted to take this further, then you may wish to consider using the command line version instead (https://community.cisco.com and search for “eNcoreCLI” or contact the Cisco Technical Alliance crew). You would still have work to do. It's not built to run as a windows service and you'd need to bypass encore.sh but it's possible to run directly in python from the command line. The other thing that's not ideal in windows is that it doesn't have a clean way of handling SIGs like Linux - but there's even some code in there (search windows.py) which listens for enter key press events.

Good luck!

[oagtexas]

Thanks for this. Very helpful.

[mstjohn_splunk]

Hi @oagtexas! In general, your question has a greater chance of being answered by experts in the Answers community when when you provide as much information and context as possible. Thanks.