All Apps and Add-ons

Cisco eStreamer eNcore Add-on for Splunk: Does anybody have core Python code running on the Windows servers?

Explorer

Yes, I read the documentation but "not supported" is often different than "doesn't work". Anybody have this working on Windows before I spend too much time on it? Any tweaks or anything to make this work?

0 Karma
1 Solution

Path Finder

The core python code definitely works on Windows, but what won't work is the wrapper shell scripts for Splunk - splencore.sh and configure.sh.

  • splencore.sh is used by the data input which keeps it running
  • configure.sh is used by the configuration screen

If you were prepared to configure it manually, you could ignore configure.sh. Then you'd just need to workaround splencore.sh - either powershell or python might be a sensible starting point.

It you really wanted to take this further, then you may wish to consider using the command line version instead (https://community.cisco.com and search for “eNcoreCLI” or contact the Cisco Technical Alliance crew). You would still have work to do. It's not built to run as a windows service and you'd need to bypass encore.sh but it's possible to run directly in python from the command line. The other thing that's not ideal in windows is that it doesn't have a clean way of handling SIGs like Linux - but there's even some code in there (search windows.py) which listens for enter key press events.

Good luck!

View solution in original post

Builder

This is not supported on Windows, Yet. There will be a developer working on it at the end of the year. I cannot commit to a date yet until it's scoped and know what's involved in getting past the outstanding issues.

Explorer

Thanks for the update!

0 Karma

Path Finder

The core python code definitely works on Windows, but what won't work is the wrapper shell scripts for Splunk - splencore.sh and configure.sh.

  • splencore.sh is used by the data input which keeps it running
  • configure.sh is used by the configuration screen

If you were prepared to configure it manually, you could ignore configure.sh. Then you'd just need to workaround splencore.sh - either powershell or python might be a sensible starting point.

It you really wanted to take this further, then you may wish to consider using the command line version instead (https://community.cisco.com and search for “eNcoreCLI” or contact the Cisco Technical Alliance crew). You would still have work to do. It's not built to run as a windows service and you'd need to bypass encore.sh but it's possible to run directly in python from the command line. The other thing that's not ideal in windows is that it doesn't have a clean way of handling SIGs like Linux - but there's even some code in there (search windows.py) which listens for enter key press events.

Good luck!

View solution in original post

Explorer

Thanks for this. Very helpful.

0 Karma

Splunk Employee
Splunk Employee

Hi @oagtexas! In general, your question has a greater chance of being answered by experts in the Answers community when when you provide as much information and context as possible. Thanks.

0 Karma