All Apps and Add-ons

eStreamer for Splunk. Unable to get certificate : Mac verify error: invalid password?

matthewssa
Path Finder

alt text

Hello!

I've stumbled across an interesting error with eStreamer. It is returning that there is a invalid password which can not be the case. I've opened up the key being used in the eStreamer.conf file with the exact same password and it shows OK and the expiration date is OK. It is a new key and I have also tried updating the eStreamer app from 2.2.1 to 2.2.2 with still no luck. Any ideas?

0 Karma
1 Solution

matthewssa
Path Finder

Wanted to come back to post the fix for anyone else that may run into this issue in the future. The fix was related to a password issue in the configuration file. When I went back and checked on the password on the back end there was no single quotes around the password. Once this was changed our Splunk instance started receiving logs from eStreamer right away. Ex: 'your_password'

View solution in original post

douglashurd
Builder

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

0 Karma

matthewssa
Path Finder

Wanted to come back to post the fix for anyone else that may run into this issue in the future. The fix was related to a password issue in the configuration file. When I went back and checked on the password on the back end there was no single quotes around the password. Once this was changed our Splunk instance started receiving logs from eStreamer right away. Ex: 'your_password'

JackV
New Member

Thanks for the tip Matthew! This fixed my issue just now!

0 Karma

jordanmedved
Explorer

Wow! I wish I would have found this answer hours ago. I had to edit local/estreamer.conf to add the tick marks around the password... Maybe the app can be updated to do this automatically? I never would have figured that out.

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...