All Apps and Add-ons

Cisco eStreamer for Splunk: Why am I receiving a "KeyError: 'elements'" error when trying to access settings?

Path Finder

After installing the Cisco eStreamer for Splunk App, whenever I try to access the settings page for the App, I get an error 500 on the browser, and the logs show the following:

2016-09-20 13:25:47,212 DEBUG   [57e1711a627f91705453d0] _cplogging:55 - [20/Sep/2016:13:25:47] HTTP Traceback (most recent call last):
  File "/opt/splunk/lib/python2.7/site-packages/cherrypy/", line 606, in respond
    cherrypy.response.body = self.handler()
  File "/opt/splunk/lib/python2.7/site-packages/cherrypy/", line 25, in __call__
    return self.callable(*self.args, **self.kwargs)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 366, in default
    return, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 38, in rundecs
    return fn(*a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 118, in check
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 167, in validate_ip
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 335, in preform_sso_check
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 387, in check_login
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 407, in handle_exceptions
    return fn(self, *a, **kw)
  File "<string>", line 1, in <lambda>
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/lib/", line 462, in apply_cache_headers
    response = fn(self, *a, **kw)
  File "/opt/splunk/lib/python2.7/site-packages/splunk/appserver/mrsparkle/controllers/", line 1567, in listEntities
    self.flattenElements(uiHelper['elements'], uiHelper_elements)
KeyError: 'elements'

This is with Splunk 6.3.2 on CentOS/7

0 Karma


Once we verify operation on these newer version we'll update the splunk apps page. We don't know of any inherent incompatibilities presently. In our demo lab here at Cisco we are running Firepower 6.0.1 with Splunk 6.4.3 and it works well and there were no install problems. Working on understanding where these errors are coming from.

Long term we are looking to have a new app built that updated schema and provides some other features. We may even offer a premium support service (for a modest charge) on the app for customers that want to be able to contact Cisco TAC for assistance.

Splunk Employee
Splunk Employee

I just visited the app download page, and noticed the supported version is v6.0. and v6.1.
I think deep investigation and fix should be done by the author of the app. That's probably shortest path unless someone is happy to check the component of app and see any incompatible part with v6.3.x.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...