All Apps and Add-ons

Cisco eStreamer eNcore Add-on for Splunk v4.0.11 Unable to parse nav XML for app=eStreamer-Dashboard

g_paternicola
Path Finder

Hi everyone,

I have installed and configured the following 2 Apps:

http://apps.splunk.com/app/3662
http://apps.splunk.com/app/3663

based on the instruction on this page: https://www.cisco.com/c/en/us/td/docs/security/firepower/670/api/eStreamer_enCore/eStreamereNcoreSpl...

the configuration went pretty good and I could get a successful connection to the eStreamer. 

As I wanted to search for sourcetype="cisco:estreamer:data" there were no data coming in. 
I can prove that a lot of data is sent to Splunk with the command:

tcpdump port 8302


Once I'm looking for index=_internal estreamer (log_level=ERROR OR log_level=WARN) there are a lot of error message like this:

ERROR	[604f2bfe5a7f42306d1990] appnav:186 - Unable to parse nav XML for app=eStreamer-Dashboard; Unicode strings with encoding declaration are not supported. Please use bytes input or XML fragments without declaration.


Could someone please help me, I don't have any idea why I'm getting this error...

Thank you very much

Labels (2)
Tags (3)
0 Karma
1 Solution

g_paternicola
Path Finder

Nevermind. I have found the solution by myself. There is an error for the xml encoding in the default file.

Instead of:

<?xml version="1.0" encoding="UTF-8"?>

should be:

<?xml version="1.0"?>


The file can be found in the App eStreamer-Dashboard on the Navigation Menu and the entry is called "default"

View solution in original post

0 Karma

g_paternicola
Path Finder

Nevermind. I have found the solution by myself. There is an error for the xml encoding in the default file.

Instead of:

<?xml version="1.0" encoding="UTF-8"?>

should be:

<?xml version="1.0"?>


The file can be found in the App eStreamer-Dashboard on the Navigation Menu and the entry is called "default"

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...

Reminder! Splunk Love Promo: $25 Visa Gift Card for Your Honest SOAR Review With ...

We recently launched our first Splunk Love Special, and it's gone phenomenally well, so we're doing it again, ...