Hi @deca2499  I ran into this same problem just this morning. I've since figured out how to resolve the issue: Update the following setting in web.conf on your search head: splunkdConnectionTimeout I set mine to 180, and was finally able to export large result sets.   Hope this helps! ... View more

Confirmed working here. I initially found and applied all the same changes except for switching it back to _TCP_ROUTING. I mistakenly used the R7 documentation, and set it to _SYSLOG_ROUTING, which caused it to fail. Once I corrected that, I now have events populating my Insight console through the relevant connectors. Thanks for the solid info! Rapid7 would be better off just deleting their documentation, as it would reduce a ton of confusion around this integration. ... View more

Fully agree on all points below. I also refused to make changes in system/local, and instead applied them in the app local folder. I initially set them up per Splunk-specifications with _TCP_ROUTING, but changed them last-minute after making the mistake of reading R7 documentation. I've since returned them to the original config this morning, and will update you (+upvote the solution) once we confirm they are up and running. ... View more

I agree on the documentation-fail at R7. We are also trying to get the same integrations to work this week. If I come across any successes, I'll share them. I'd appreciate the same if you make any progress. Thanks, and good luck! ... View more

OK, I found the issue, and it's a big dumb one on my part. I pushed this app via the deployment server to the required heavy forwarders. When I changed the assigned server-classes, it set the "restart splunkd" option in the app back to the default of "no". So the app was installed, but splunkd was never restarted. I apologize for taking up your time, this was my fault (typical, eh?) and I have the setup page working now. Thanks again. ... View more

Weird, my reply disappeared when I added links to the screenshots. Sorry, you'll just have to take my word that I am indeed using the "apps management" page in Splunk 7.1.1 located here: https://my_splunk_server:8000/en-US/manager/launcher/apps/local I am clicking the "set up" link for eStreamer eNcore, which links to this URL: https://my_splunk_server:8000/en-US/manager/TA-eStreamer/apps/local/TA-eStreamer/setup?action=edit What I receive is a page that says "404 not found" at the top-left of the page, has the image of a horse standing there confused, and the text "Oops. Page not found! Click here to return to Splunk homepage." I do not see any other page displayed. I will re-install the TA, as that is a trivial process. Up to this point, all I've had to do is extract the archive, and copy the pkcs12 file into the correct location post-install, and restart Splunk. The next step after that is to log in at the console and click the setup link. If re-installation nets me any different behavior, I'll post it here in the next 10-15 minutes. Otherwise, my silence will indicate that the app is still broken. If it makes any difference, this is a brand-new installation of Splunk Enterprise 7.1.1. I have other apps installed and working successfully without issue. Oops, I forgot to mention, the "setup.xml" file does exist at "/opt/splunk/etc/apps/TA-eStreamer/default/setup.xml" ... View more

I'll attach screenshots. The first is the page I use to click the "setup" link with the link circled in red, and the 2nd is the resultant 404 page I receive. I do not see any other screen than those provided below. I have no problem re-installing encore, since up to this point, everything is rather trivial to do. It's just an archive extraction, and copying the pkcs12 file to the right location. After that, I am at the point where I am required to use the setup link. I'll re-install this morning. The images don't look like they want to display in-line, so here are the links: https://postimg.cc/image/jgm39yv25/ https://postimg.cc/image/ypc0nw9ct/ ... View more

I should have mentioned that I tried that as well. I get the following error when I run that command: /opt/splunk/bin/splunk cmd ./splencore.sh test You have not configured your FMC host The FMC host is configured by clicking the "setup" link. That link is what is generating the 404 error. Thanks ... View more

I am also receiving a 404 error when clicking on the "set up" link in the manage app page. I have applied the fix mentioned above. Line 20 in configure.sh is now: exec >>configuration.log 2>&1 However, I still get the 404 error when trying to access the setup. When I run the search provided above, the result I see is: ERROR SetupAdminHandler - Error while fetching url=/servicesNS/nobody/TA-eStreamer/encore/configure/main/?_strict=true;search=%20eai%3Aacl.app%3D%22%22%20OR%20eai%3Aacl.app%3D%22TA-eStreamer%22 I am running Enterprise Splunk version 7.1.1 with a search-head, distributed indexers, and several heavy forwarders. I have installed the TA to the heavy-forwarder which will be receiving the data from my FMC. I am using the web-interface of the heavy-forwarder to set up the TA. I'd love to get some suggestions for other steps I could take to resolve this issue. Thanks! ... View more

Unfortunately I'm dealing with a large distributed network of a few thousand hosts across dozens of subnets. I was hoping for something a bit more scalable. I appreciate your input, and thanks for your time. ... View more