eStreamer for Splunk. Unable to get certificate : Mac verify error: invalid password?

[matthewssa]

Hello!

I've stumbled across an interesting error with eStreamer. It is returning that there is a invalid password which can not be the case. I've opened up the key being used in the eStreamer.conf file with the exact same password and it shows OK and the expiration date is OK. It is a new key and I have also tried updating the eStreamer app from 2.2.1 to 2.2.2 with still no luck. Any ideas?

[douglashurd]

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

[matthewssa · Accepted solution]

Wanted to come back to post the fix for anyone else that may run into this issue in the future. The fix was related to a password issue in the configuration file. When I went back and checked on the password on the back end there was no single quotes around the password. Once this was changed our Splunk instance started receiving logs from eStreamer right away. Ex: 'your_password'

[JackV]

Thanks for the tip Matthew! This fixed my issue just now!

[jordanmedved]

Wow! I wish I would have found this answer hours ago. I had to edit local/estreamer.conf to add the tick marks around the password... Maybe the app can be updated to do this automatically? I never would have figured that out.