Sourcefire estreamer

timlaw71 · ‎09-09-2013

I'm trying to get estreamer working on splunk. I have downloaded the splunk app and configured the files in the app according to the README. The ssl_test.pl script works but when I run the estreamer.py script I get
Traceback (most recent call last):
File "./estreamer.py", line 10, in
APP_PATH = os.path.join(os.environ["SPLUNK_HOME"], 'etc', 'apps', 'Sourcefire')
File "/usr/lib64/python2.6/UserDict.py", line 22, in getitem
raise KeyError(key)
KeyError: 'SPLUNK_HOME'
Any help would be appreciated.

Thanks,
Tim

edbolton · ‎09-24-2013

You need to export the envrionment variable SPLUNK_HOME in your shell.

KeyError: 'SPLUNK_HOME'

Sourcefire estreamer

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform

Join the Conversation

Sourcefire estreamer

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

All Work and No Play? Not at .conf26! Unwind at These Evening Events

Join the Hackathon at .conf26 and build a No-Code AI agent

Level Up Your Workflow: Mastering Splunk Cloud Management via Terraform