We experienced this exact error without much of explanation. But the Add-On documentation states the following in the Troubleshooting Section: Ensure that the Event Stream API has been enabled for the CID The Crowdstrike API Documentation agrees and states the following for Event Streams, specifically if you're a GovCloud customer.   After opening up a ticket with Crowdstrike and asking them to enable the event streams on our CID, the error cleared up and logs began to populate. ... View more

I ran into the same issue for Falcon Crowdstrike Event Streams and the Splunk Add-On for AWS on my Heavy Forwarders. This indicates it was likely a Splunk config issue, rather than a Splunk app issue.   Splunk Support recommended the following, which fixed the problem right away. The value for one of the parameters in the server.conf file is not set up in the expected format. Please perform the below steps in your HF in which the Box add-on UI page(s) are not loading properly: 1.Go to /splunk/etc/system/local/server.conf file. 2.Update the value of the enableSplunkdSSL parameter from True to true on the [sslConfig] stanza. 3.Restart the HF. If your server.conf file doesn't specifically have an invalid enableSplunkdSSL attribute, then I suspect that your issue may be some other SSL configuration. It's worth noting too that using splunk cmd btool check --debug did not detect this issue during troubleshooting. ... View more