All Apps and Add-ons

Cisco eStreamer eNcore Add-on for Splunk v4.0.11 Unable to parse nav XML for app=eStreamer-Dashboard

g_paternicola
Path Finder

Hi everyone,

I have installed and configured the following 2 Apps:

http://apps.splunk.com/app/3662
http://apps.splunk.com/app/3663

based on the instruction on this page: https://www.cisco.com/c/en/us/td/docs/security/firepower/670/api/eStreamer_enCore/eStreamereNcoreSpl...

the configuration went pretty good and I could get a successful connection to the eStreamer. 

As I wanted to search for sourcetype="cisco:estreamer:data" there were no data coming in. 
I can prove that a lot of data is sent to Splunk with the command:

tcpdump port 8302


Once I'm looking for index=_internal estreamer (log_level=ERROR OR log_level=WARN) there are a lot of error message like this:

ERROR	[604f2bfe5a7f42306d1990] appnav:186 - Unable to parse nav XML for app=eStreamer-Dashboard; Unicode strings with encoding declaration are not supported. Please use bytes input or XML fragments without declaration.


Could someone please help me, I don't have any idea why I'm getting this error...

Thank you very much

Labels (2)
Tags (3)
0 Karma
1 Solution

g_paternicola
Path Finder

Nevermind. I have found the solution by myself. There is an error for the xml encoding in the default file.

Instead of:

<?xml version="1.0" encoding="UTF-8"?>

should be:

<?xml version="1.0"?>


The file can be found in the App eStreamer-Dashboard on the Navigation Menu and the entry is called "default"

View solution in original post

0 Karma

g_paternicola
Path Finder

Nevermind. I have found the solution by myself. There is an error for the xml encoding in the default file.

Instead of:

<?xml version="1.0" encoding="UTF-8"?>

should be:

<?xml version="1.0"?>


The file can be found in the App eStreamer-Dashboard on the Navigation Menu and the entry is called "default"

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...