Cisco eStreamer eNcore for Splunk Operations Guide 3.0

[Rahul Govindan]

Tried setting up with FMC 6.2.1. Getting the error "Encountered the following error while trying to update: Error while posting to url=/servicesNS/nobody/TA-eStreamer/encore/configure/main" when adding the Pkcs12 certificate in the App setup page. Tried with and without the password. Splunk version 6.6.2.

[dohurd]

Rahul,

This is blocked by an issue we’re seeing with Splunk not returning error messages as we might expect. If this were resolved we could put nicer error messages on screen.

Could you log onto the splunk box and look in the contents of:

/opt/splunk/etc/apps/TA-eStreamer/bin/encore/configuration.log

We're talking to Splunk about this issue to determine root cause.  If you could provide the info above it might help us.

Doug

[cbacon0011]

Set up with FMC 6.2.1. Splunk version 6.5.1. Everything seems to be configured correctly, as it works for a while, then drops the connection. Getting the following error:

EncoreException: The server returned an invalid version (0) - expected 1. This is likely to be caused by CSCve44987 which is present on both FMC 6.1.0.3 and 6.2.0.1. For more information see: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCve44987. Message={'messageType': 0, 'length': 0, 'version': 0}

Traceback (most recent call last):

File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/subscriber.py", line 219, in start\n self.__tryHandleNextResponse()

File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/subscriber.py", line 158, in __tryHandleNextResponse\n message = self.connection.response()

File "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/estreamer/connection.py", line 203, in response\n raise estreamer.EncoreException( errMsg.format( version, str(message) ))

EncoreException: The server returned an invalid version (0) - expected 1. This is likely to be caused by CSCve44987 which is present on both FMC 6.1.0.3 and 6.2.0.1. For more information see: https://bst.cloudapps.cisco.com/bugsearch/bug/CSCve44987. Message={'messageType': 0, 'length': 0, 'version': 0}

[Rahul Govindan]

I was able to get this to work. I believe the error is cosmetic as the changes do take effect. 

I looked into my server and the "/opt/splunk/etc/apps/TA-eStreamer/bin/encore/configuration.log" file is empty. Is there another file name for it?

[dohurd]

Have you applied either the 6.2.1.5 patch or the 6.2.0.2 patch and still had issues?  Its critical to patch past the bug you reference.

[cbacon0011]

I have not patched yet. I will check on patch availability. Thanks.