Did you ever find a resolve to these errors or determine if they were impacting? To me it seems like there is some type of packet capture the app just cannot handle.
I am running Splunk 8+, Python 2.7.16 and I am seeing similar errors:
# estreamer.pipeline ERROR Additional data: KGRwMApTJ3ZlcnNpb24nCnA...<omitted>
# streamer.pipeline ERROR error: unpack requires a string argument of length 4\nTraceback (most recent call last):\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/pipeline.py", line 139, in parse\n parser.parse()\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/adapters/binary.py", line 512, in parse\n self._parse( self.data, self.offset, self.record )\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/adapters/binary.py", line 406, in _parse\n offset = self._parseAttributes( data, offset, attributes, record )\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/adapters/binary.py", line 394, in _parseAttributes\n offset = self._parseBlock( data, offset, attribute, block )\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/adapters/binary.py", line 210, in _parseBlock\n offset = self._parseAttributes( data, offset, blockDefinition, context )\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/adapters/binary.py", line 394, in _parseAttributes\n offset = self._parseBlock( data, offset, attribute, block )\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/adapters/binary.py", line 210, in _parseBlock\n offset = self._parseAttributes( data, offset, blockDefinition, context )\n File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/adapters/binary.py", line 362, in _parseAttributes\n data[ offset : offset + byteLength ] )[ 0 ]\nerror: unpack requires a string argument of length 4\n
