https://community.splunk.com/t5/All-Apps-and-Add-ons/Receiving-many-error-messages-for-python-scripts-from-splunk-ta/m-p/449017#M55226 <P>Thanks, I'll raise a case with cloud ops to get this done, thanks for the response. <BR /> I'll let you know what happens.<BR /> Cheers</P> Tue, 25 Jun 2019 23:17:30 GMT markhill1 2019-06-25T23:17:30Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Receiving-many-error-messages-for-python-scripts-from-splunk-ta/m-p/449015#M55224 <P>Hi Palo people, we are seeing thousands of errors from the various python scripts within the Palo Alto TA. (V6.1.1).<BR /> Examples:</P> <PRE><CODE>ERROR ExecProcessor - message from "python /opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/autofocus_export.py" File "/opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/solnlib/packages/splunklib/binding.py", line 287, in wrapper ERROR ExecProcessor - message from "python /opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/autofocus_export.py" File "/opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/modinput_wrapper/base_modinput.py", line 113, in stream_events ERROR ExecProcessor - message from "python /opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/autofocus_export.py" File "/opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/splunk_ta_paloalto/splunktaucclib/global_config/configuration.py", line 264, in load ERROR ExecProcessor - message from "python /opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/autofocus_export.py" self.parse_input_args(input_definition) ERROR ExecProcessor - message from "python /opt/splunk/etc/slave-apps/Splunk_TA_paloalto/bin/autofocus_export.py" HTTPError: HTTP 500 Internal Server Error -- {"messages":[{"type":"ERROR","text":"Cannot call handler 'Splunk_TA_paloalto_account' due to missing script 'Splunk_TA_paloalto_rh_account.py'."}]} </CODE></PRE> <P>These are just some examples there are more. We have it installed one of the Splunk Cloud instances we manage. <BR /> The errors are coming from the indexers. We asked for it to be installed on our ES search head.<BR /> We aren't using the TA to pull any data in, we are just using it for the props and transforms on the ES search head. <BR /> It is also installed on the on-prem HWF.<BR /> Can you please let us know how we may be able to fix this?<BR /> Thanks.</P> Tue, 25 Jun 2019 22:39:00 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Receiving-many-error-messages-for-python-scripts-from-splunk-ta/m-p/449015#M55224 markhill1 2019-06-25T22:39:00Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Receiving-many-error-messages-for-python-scripts-from-splunk-ta/m-p/449016#M55225 <P>Try adding this to local/inputs.conf</P> <PRE><CODE>[autofocus_export] disabled = true </CODE></PRE> Tue, 25 Jun 2019 23:00:35 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Receiving-many-error-messages-for-python-scripts-from-splunk-ta/m-p/449016#M55225 panguy 2019-06-25T23:00:35Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Receiving-many-error-messages-for-python-scripts-from-splunk-ta/m-p/449017#M55226 <P>Thanks, I'll raise a case with cloud ops to get this done, thanks for the response. <BR /> I'll let you know what happens.<BR /> Cheers</P> Tue, 25 Jun 2019 23:17:30 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Receiving-many-error-messages-for-python-scripts-from-splunk-ta/m-p/449017#M55226 markhill1 2019-06-25T23:17:30Z https://community.splunk.com/t5/All-Apps-and-Add-ons/Receiving-many-error-messages-for-python-scripts-from-splunk-ta/m-p/449018#M55227 <UL> <LI>Resolved by removing Splunk_TA_paloalto from the Indexers. Was not required there as was also installed on the on-prem HWF.</LI> </UL> Wed, 30 Sep 2020 01:08:28 GMT https://community.splunk.com/t5/All-Apps-and-Add-ons/Receiving-many-error-messages-for-python-scripts-from-splunk-ta/m-p/449018#M55227 mdillon_splunk 2020-09-30T01:08:28Z