All Apps and Add-ons

Why am I getting error "Splunk cannot find "apps/local/eStreamer/setup"" trying to configure Cisco eStreamer for Splunk?

jwalzerpitt
Influencer

When I go to configure the Cisco eStreamer for Splunk app, I get the following error message:

Splunk could not perform action for resource apps/local/eStreamer (404, u'Splunk cannot find "apps/local/eStreamer/setup". [HTTP 404] https://127.0.0.1:8089/servicesNS/admin/eStreamer/apps/local/eStreamer/setup; [{\'text\': "\\n In handler \'localapps\': Error while fetching url=/servicesNS/nobody/eStreamer/estreamer/configuration/estreamer/?_strict=true;search=%20eai%3Aacl.app%3D%22%22%20OR%20eai%3Aacl.app%3D%22eStreamer%22", \'type\': \'ERROR\', \'code\': None}]')
There was an error retrieving the configuration, can not process this page.

Any help troubleshooting this error message would be appreciated.

Please note, my Splunk instance is installed in /data/splunk, not /opt/splunk...

Thx

0 Karma

douglashurd
Builder

A new Splunk Firepower solution is now available if you are using Firepower version 6.x. You can download the new eStreamer eNcore for Splunk and the separately installable dashboard from the two links below:

eStreamer eNcore
https://splunkbase.splunk.com/app/3662/

eNcore Dashboard
https://splunkbase.splunk.com/app/3663/

It is free to use and well documented but if you would like to purchase a TAC Support service so that you can obtain installation and configuration assistance and troubleshooting you can order the software from Cisco (support obligatory with this purchase). The Product Identifier is: FP-SPLUNK-SW-K9.

Regardless of whether you take up the support option or not, updated versions will be made available to all free of charge and posted on Splunkbase as well as Cisco Downloads.

0 Karma

douglashurd
Builder

Try the default path /opps/splunk

This might work. Not completely sure.

0 Karma

jwalzerpitt
Influencer

Doug,

What do I need to try in the default path for /opt/splunk?

Thx

0 Karma

maciep
Champion

I don't know much about this app, but it looks like there is some prep work involved. Did you run through those steps?
https://splunkbase.splunk.com/app/1629/#/documentation

Also, reading about that rest endpoint, there should be a setup.xml in the default directory of the app. Do you see that file if you navigate there directly (/data/splunk/etc/apps/estreamer/default)?
http://docs.splunk.com/Documentation/Splunk/6.2.6/RESTREF/RESTapps#apps.2Flocal.2F.7Bname.7D.2Fsetup

GET apps/local/{name}/setup

Usage details
Some apps contain setup scripts that must be run before the app is enabled. For those apps, the setup.xml file must exist in the $SPLUNK_BASE\etc\apps\<appname>\default directory.
0 Karma

jwalzerpitt
Influencer

Thx for the reply

I did walk through the prep work and I'm good to go there.

There is a setup.xml file in /data/splunk/etc/apps/eStreamer/default.

The weird thing is that when I select the app from within Splunk, I can now the see the dashboards. I haven't changed a thing so I am not sure as to why all of the sudden it's working (dashboards are - still need to forward the data from our SourceFire manager).

Thx again

0 Karma

jwalzerpitt
Influencer

Another weird thing I noticed is that if I log in with my user account, I can see the dashboard. When I log in as Splunk admin, that's when I get the error message when I try and setup the app

0 Karma

maciep
Champion

hmm...my guess would be that the app set is_configured=true in the app.conf file. But whichever copy it updated is accessible to your account by not the admin account.

0 Karma

jwalzerpitt
Influencer

Checking the app.conf I see the following:

is_configured = 0

0 Karma

maciep
Champion

which app.conf did you check? /data/splunk/etc/apps/eStreamer/default, /data/splunk/etc/apps/eStreamer/local, /data/splunk/etc/users[your account]/eStreamer/local.

If it's set to 0 everywhere, then i don't know why it works for your account. Maybe somebody else with experience with that app can help

0 Karma

jwalzerpitt
Influencer

The file app.conf only exists in /data/splunk/etc/apps/eStreamer/default.

There is no data/splunk/etc/apps/eStreamer/local directory, and no /data/splunk/etc/users[your account]/eStreamer/local directory (only history and metadata)

Thx

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...