Exec Process error

fedayn05 — Thu, 30 Oct 2025 14:12:41 GMT

Hello everyone,

I have just deployed Splunk ES and I am getting a lot of these errors :

"Health Check: msg="A script exited abnormally with exit status: 1" input="./opt/splunk/etc/apps/DA-ESS-ThreatIntelligence/bin/threatmatch.py" stanza="threatmatch://registry_value_text""

I run the following SPL : index=_internal sourcetype=splunkd threatmatch.py and the results are :

INFO ExecProcessor [2071531 ExecProcessor] - New scheduled exec process: /opt/splunk/bin/python3.9 /opt/splunk/etc/apps/DA-ESS-ThreatIntelligence/bin/threatmatch.py

Any idea please how can i resolve this , as it causes delayed searches for Splunk ES.

Thank you

Re: Exec Process error

tscroggins — Wed, 05 Nov 2025 16:03:35 GMT

Hi @fedayn05,

Which versions of Splunk Enterprise and Splunk Enterprise Security do you have installed?

Splunk Enterprise 9.0.1 deprecates and Splunk Enterprise 10.0 disables the REST API search/parser endpoint used by earlier versions of Splunk Enterprise Security to validate the data models used by the threatmatch modular input.

If you're running Splunk Enterprise 10.0, ensure you're also running Splunk Enterprise Security 7.3.4 or a later version of Splunk Enterprise Security compatible with Splunk Enterprise 10.0 and the v2 REST API.

topic Re: Exec Process error in Splunk Enterprise

Exec Process error

Re: Exec Process error