All Apps and Add-ons

Cisco eStreamer for Splunk: Why am I receiving a "KeyError: 'elements'" error when trying to access settings?

Path Finder

After installing the Cisco eStreamer for Splunk App, whenever I try to access the settings page for the App, I get an error 500 on the browser, and the logs show the following:

2016-09-20 13:25:47,212 DEBUG   [57e1711a627f91705453d0] _cplogging:55 - [20/Sep/2016:13:25:47] HTTP Traceback (most recent call last):
  File "/opt/splunk/lib/python2.7/site-packages/cherrypy/", line 606, in respond
    cherrypy.response.body = self.handler()
  File "/opt/splunk/lib/python2.7/site-packages/cherrypy/", line 25, in __call__
    return self.callable(*self.args, **self.kwargs)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 366, in default
    return, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 38, in rundecs
    return fn(*a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 118, in check
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 167, in validate_ip
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 335, in preform_sso_check
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 387, in check_login
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 407, in handle_exceptions
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 462, in apply_cache_headers
    response = fn(self, *a, **kw)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/", line 1567, in listEntities
    self.flattenElements(uiHelper['elements'], uiHelper_elements)
KeyError: 'elements'

This is with Splunk 6.3.2 on CentOS/7

0 Karma


Once we verify operation on these newer version we'll update the splunk apps page. We don't know of any inherent incompatibilities presently. In our demo lab here at Cisco we are running Firepower 6.0.1 with Splunk 6.4.3 and it works well and there were no install problems. Working on understanding where these errors are coming from.

Long term we are looking to have a new app built that updated schema and provides some other features. We may even offer a premium support service (for a modest charge) on the app for customers that want to be able to contact Cisco TAC for assistance.

Splunk Employee
Splunk Employee

I just visited the app download page, and noticed the supported version is v6.0. and v6.1.
I think deep investigation and fix should be done by the author of the app. That's probably shortest path unless someone is happy to check the component of app and see any incompatible part with v6.3.x.

0 Karma
Get Updates on the Splunk Community!

Splunk Education - Fast Start Program!

Welcome to Splunk Education! Splunk training programs are designed to enable you to get started quickly and ...

Five Subtly Different Ways of Adding Manual Instrumentation in Java

You can find the code of this example on GitHub here. Please feel free to star the repository to keep in ...

New Splunk APM Enhancements Help Troubleshoot Your MySQL and NoSQL Databases Faster

Splunk Observability has two new enhancements to make it quicker and easier to troubleshoot slow or frequently ...