All Apps and Add-ons

Cisco eStreamer for Splunk: Why am I receiving a "KeyError: 'elements'" error when trying to access settings?

Path Finder

After installing the Cisco eStreamer for Splunk App, whenever I try to access the settings page for the App, I get an error 500 on the browser, and the logs show the following:

2016-09-20 13:25:47,212 DEBUG   [57e1711a627f91705453d0] _cplogging:55 - [20/Sep/2016:13:25:47] HTTP Traceback (most recent call last):
  File "/opt/splunk/lib/python2.7/site-packages/cherrypy/", line 606, in respond
    cherrypy.response.body = self.handler()
  File "/opt/splunk/lib/python2.7/site-packages/cherrypy/", line 25, in __call__
    return self.callable(*self.args, **self.kwargs)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 366, in default
    return, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 38, in rundecs
    return fn(*a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 118, in check
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 167, in validate_ip
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 335, in preform_sso_check
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 387, in check_login
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 407, in handle_exceptions
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 462, in apply_cache_headers
    response = fn(self, *a, **kw)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/", line 1567, in listEntities
    self.flattenElements(uiHelper['elements'], uiHelper_elements)
KeyError: 'elements'

This is with Splunk 6.3.2 on CentOS/7

0 Karma


Once we verify operation on these newer version we'll update the splunk apps page. We don't know of any inherent incompatibilities presently. In our demo lab here at Cisco we are running Firepower 6.0.1 with Splunk 6.4.3 and it works well and there were no install problems. Working on understanding where these errors are coming from.

Long term we are looking to have a new app built that updated schema and provides some other features. We may even offer a premium support service (for a modest charge) on the app for customers that want to be able to contact Cisco TAC for assistance.

Splunk Employee
Splunk Employee

I just visited the app download page, and noticed the supported version is v6.0. and v6.1.
I think deep investigation and fix should be done by the author of the app. That's probably shortest path unless someone is happy to check the component of app and see any incompatible part with v6.3.x.

0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...