Sourcefire estreamer

timlaw71 · ‎09-09-2013

I'm trying to get estreamer working on splunk. I have downloaded the splunk app and configured the files in the app according to the README. The ssl_test.pl script works but when I run the estreamer.py script I get
Traceback (most recent call last):
File "./estreamer.py", line 10, in
APP_PATH = os.path.join(os.environ["SPLUNK_HOME"], 'etc', 'apps', 'Sourcefire')
File "/usr/lib64/python2.6/UserDict.py", line 22, in getitem
raise KeyError(key)
KeyError: 'SPLUNK_HOME'
Any help would be appreciated.

Thanks,
Tim

edbolton · ‎09-24-2013

You need to export the envrionment variable SPLUNK_HOME in your shell.

KeyError: 'SPLUNK_HOME'

Sourcefire estreamer

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future

Join the Conversation

Sourcefire estreamer

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Why Splunk Customers Should Attend Cisco Live 2026 Las Vegas

What Is the Name of the USB Key Inserted by Bob Smith? (BOTS Hint, Not the Answer)

Automating Threat Operations and Threat Hunting with Recorded Future