topic Re: VT4Splunk app configuration page is erroring in Splunk Enterprise

VT4Splunk app configuration page is erroring

ganji — Thu, 13 Feb 2025 23:10:02 GMT

When I open the configuration page, VT4Splunk app throws an error. I am on Splunk 9.2.2

kiran_panchavat — Fri, 14 Feb 2025 05:55:23 GMT

1. Check splunkd.log

index=_internal source=*splunkd.log  VT4Splunk

OR

/opt/splunk/var/log/splunk/splunkd.log | grep -i "VT4Splunk"

2. Uninstall and reinstall the app

kiran_panchavat — Fri, 14 Feb 2025 05:58:54 GMT

kiran_panchavat — Fri, 14 Feb 2025 06:03:58 GMT

@ganji What is the ERROR code?

ganji — Fri, 14 Feb 2025 15:05:33 GMT

Here are some internal logs.

02-14-2025 08:57:21.124 -0600 ERROR PersistentScript [3645488 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/etc/apps/TA-virustotal-app/bin/lib/typing_extensions.py", line 1039
	02-14-2025 08:57:21.124 -0600 ERROR PersistentScript [3645488 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/etc/apps/TA-virustotal-app/bin/lib/aiohttp/hdrs.py", line 13, in <module>
	02-14-2025 08:57:21.124 -0600 ERROR PersistentScript [3645488 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/etc/apps/TA-virustotal-app/bin/lib/aiohttp/__init__.py", line 5, in <module>
	02-14-2025 08:57:21.124 -0600 ERROR PersistentScript [3645488 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/etc/apps/TA-virustotal-app/bin/lib/vt/client.py", line 23, in <module>

ganji — Fri, 14 Feb 2025 15:07:46 GMT

I tried installing it in multiple instances and got the same error. Splunk version is 9.2.2

meekah — Tue, 18 Feb 2025 19:50:45 GMT

It appears that the latest version of this app is having this issue. Uninstall it and install an older version

ganji — Mon, 24 Feb 2025 16:17:02 GMT

Unfortunately, older versions are not Cloud compatible.