I have installed the Cisco eStreamer for Splunk app, but after running the setup, the estreamer isn't running?
So when i run ./client_check.py
i get the following error:
status_id=-1 status="ERROR: The app has not yet been setup."
I am running redhat and all the perl modules are installed. The app is configured with the Certificate path and filename and the Defense Center IP address.
When i run ./estreamer_client.pl
i do get the following which shows that the modules are installed:
Usage: estreamer_client.pl [options]
Options:
[-c]onfig=<config filename>
[-l]ogfile=<log filename>
[-t]est
[-d]aemon
There are no debug logs, any ideas?
So after looking at this for a while i looked in client_check.py.
There are the following fields that i found:
if (platform == 'Windows'):
import win32api
splunk_path = os.getenv('SPLUNK_HOME', 'C:\Program Files\Splunk\')
splunk_path = win32api.GetShortPathName(splunk_path)
else:
splunk_path = os.getenv('SPLUNK_HOME', '/opt/splunk')
Out splunk deployment is not in /opt/splunk so i changed it to /apps/splunk.
Then when i ran ./client_check.py and got it running!
event_sec=1427362392 status_id=1 status="eStreamer client is running."
So after looking at this for a while i looked in client_check.py.
There are the following fields that i found:
if (platform == 'Windows'):
import win32api
splunk_path = os.getenv('SPLUNK_HOME', 'C:\Program Files\Splunk\')
splunk_path = win32api.GetShortPathName(splunk_path)
else:
splunk_path = os.getenv('SPLUNK_HOME', '/opt/splunk')
Out splunk deployment is not in /opt/splunk so i changed it to /apps/splunk.
Then when i ran ./client_check.py and got it running!
event_sec=1427362392 status_id=1 status="eStreamer client is running."