https://community.splunk.com/t5/Splunk-Enterprise/ERROR-ExecProcessor-cli-common-py-quot-line-504-in-getMgmtUri/m-p/753293#M23111 <P>Hi,</P><P>In Splunk Enterprise v10.0.0, the following error is reported in "splunkd.log" ever minute.</P><UL><LI>09-18-2025 22:02:00.165 +0000 ERROR ExecProcessor [2560 ExecProcessor] - message from "/cloudmark/splunk/bin/python3.9 /cloudmark/splunk/etc/apps/search/bin/quarantine_files.py" File "/cloudmark/splunk/lib/python3.9/site-packages/splunk/clilib/cli_common.py", line 504, in getMgmtUri</LI><LI>09-18-2025 22:03:00.171 +0000 ERROR ExecProcessor [2560 ExecProcessor] - message from "/cloudmark/splunk/bin/python3.9 /cloudmark/splunk/etc/apps/search/bin/quarantine_files.py" File "/cloudmark/splunk/lib/python3.9/site-packages/splunk/clilib/cli_common.py", line 504, in getMgmtUri</LI></UL><P>I narrowed to issue to URI "<STRONG>https://[::1]:8089</STRONG>" written to run file: "<STRONG>/opt/splunk/var/run/splunk/splunkd_uri.txt</STRONG>".&nbsp; It&nbsp;looks like the python helper script "<STRONG>cli_common.py</STRONG>" is not properly parsing out the IPv6 address on the colon '<FONT color="#FF6600"><STRONG>:</STRONG></FONT>' delimiter.&nbsp; The temporary fix is to modify the URI to "<STRONG><A href="https://127.0.0.1:8089" target="_blank" rel="noopener">https://127.0.0.1:8089</A></STRONG>", which resolves the ERROR.&nbsp; However, after restarting Splunkd, URI "<STRONG>https://[::1]:8089</STRONG>" is again written to run file&nbsp; &nbsp; &nbsp; &nbsp;"<STRONG>/opt/splunk/var/run/splunk/splunkd_uri.txt</STRONG>" and the ERROR reoccurs.</P><P>Looks like a fix is needed to python script "<STRONG>cli_common.py</STRONG>" but if the script file is changed, then the Splunk manifest check will complain.</P><P>Does anyone know of a permanent fix?&nbsp; &nbsp; &nbsp;&nbsp;</P> Thu, 18 Sep 2025 22:31:12 GMT ocnsinc 2025-09-18T22:31:12Z https://community.splunk.com/t5/Splunk-Enterprise/ERROR-ExecProcessor-cli-common-py-quot-line-504-in-getMgmtUri/m-p/753293#M23111 <P>Hi,</P><P>In Splunk Enterprise v10.0.0, the following error is reported in "splunkd.log" ever minute.</P><UL><LI>09-18-2025 22:02:00.165 +0000 ERROR ExecProcessor [2560 ExecProcessor] - message from "/cloudmark/splunk/bin/python3.9 /cloudmark/splunk/etc/apps/search/bin/quarantine_files.py" File "/cloudmark/splunk/lib/python3.9/site-packages/splunk/clilib/cli_common.py", line 504, in getMgmtUri</LI><LI>09-18-2025 22:03:00.171 +0000 ERROR ExecProcessor [2560 ExecProcessor] - message from "/cloudmark/splunk/bin/python3.9 /cloudmark/splunk/etc/apps/search/bin/quarantine_files.py" File "/cloudmark/splunk/lib/python3.9/site-packages/splunk/clilib/cli_common.py", line 504, in getMgmtUri</LI></UL><P>I narrowed to issue to URI "<STRONG>https://[::1]:8089</STRONG>" written to run file: "<STRONG>/opt/splunk/var/run/splunk/splunkd_uri.txt</STRONG>".&nbsp; It&nbsp;looks like the python helper script "<STRONG>cli_common.py</STRONG>" is not properly parsing out the IPv6 address on the colon '<FONT color="#FF6600"><STRONG>:</STRONG></FONT>' delimiter.&nbsp; The temporary fix is to modify the URI to "<STRONG><A href="https://127.0.0.1:8089" target="_blank" rel="noopener">https://127.0.0.1:8089</A></STRONG>", which resolves the ERROR.&nbsp; However, after restarting Splunkd, URI "<STRONG>https://[::1]:8089</STRONG>" is again written to run file&nbsp; &nbsp; &nbsp; &nbsp;"<STRONG>/opt/splunk/var/run/splunk/splunkd_uri.txt</STRONG>" and the ERROR reoccurs.</P><P>Looks like a fix is needed to python script "<STRONG>cli_common.py</STRONG>" but if the script file is changed, then the Splunk manifest check will complain.</P><P>Does anyone know of a permanent fix?&nbsp; &nbsp; &nbsp;&nbsp;</P> Thu, 18 Sep 2025 22:31:12 GMT https://community.splunk.com/t5/Splunk-Enterprise/ERROR-ExecProcessor-cli-common-py-quot-line-504-in-getMgmtUri/m-p/753293#M23111 ocnsinc 2025-09-18T22:31:12Z https://community.splunk.com/t5/Splunk-Enterprise/ERROR-ExecProcessor-cli-common-py-quot-line-504-in-getMgmtUri/m-p/753326#M23112 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/239346">@ocnsinc</a>&nbsp;</P><P>As this is an issue with a built-in script you are right that the manifest will complain about the change and also it will be overwritten in the future if you upgrade. I think the best thing to do raise with Splunk Support and hopefully they will raise a bug and get it resolved in a future release.</P><P>Head over to&nbsp;<A href="https://www.splunk.com/support" target="_blank">https://www.splunk.com/support</A>&nbsp;to raise a support case.</P><P><span class="lia-unicode-emoji" title=":glowing_star:">🌟</span><SPAN>&nbsp;</SPAN><STRONG>Did this answer help you?</STRONG><SPAN>&nbsp;</SPAN>If so, please consider:</P><UL><LI>Adding karma to show it was useful</LI><LI>Marking it as the solution if it resolved your issue</LI><LI>Commenting if you need any clarification</LI></UL><P>Your feedback encourages the volunteers in this community to continue contributing</P> Fri, 19 Sep 2025 11:39:15 GMT https://community.splunk.com/t5/Splunk-Enterprise/ERROR-ExecProcessor-cli-common-py-quot-line-504-in-getMgmtUri/m-p/753326#M23112 livehybrid 2025-09-19T11:39:15Z