https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Message/m-p/154187#M611 <P>This error is occurring because Enterprise Security contains a "configuration_checker.py" modular input that attempts to alert you when misconfigurations are detected - we attempt to be proactive and alert to conditions that might be causing the application to misbehave.</P> <P>In this case, the intent of the alert is to alert when a scripted input or modular input has exited abnormally. The definition of "abnormally" that we use means "exited with a non-zero exit code".</P> <P>Sometimes, as in this case, this particular check backfires. The error you're seeing is benign and is occurring because the scripted inputs included with the TA-windows add-on use non-zero exit codes even when they exit successfully. This has been corrected in an upcoming version (which of course doesn't help in this instance).</P> <P>If you would like to just get rid of the message, you can disable this input stanza in the Manager:</P> <PRE><CODE>Settings --&gt; Data Inputs --&gt; Configuration Checker --&gt; confcheck_script_errors </CODE></PRE> <P>However, that would disable the exit status checking for ALL scripted and modular inputs on the system. If you'd like a more robust solution, reach out to support and mention this posting, and we can provide a small patch to the configuration_checker.py script which will deal with this in a more intelligent fashion - with the caveat that it wouldn't persist beyond an upgrade.</P> Fri, 21 Feb 2014 03:11:21 GMT jervin_splunk 2014-02-21T03:11:21Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Message/m-p/154186#M610 <P>msg="A script exited abnormally" input="C:\Program Files\Splunk\bin\splunk-winprintmon.exe" stanza="default" status="exited with code -1"</P> <P>I keep getting this message, any help would be great!</P> Tue, 18 Feb 2014 00:09:13 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Message/m-p/154186#M610 careoregon 2014-02-18T00:09:13Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Message/m-p/154187#M611 <P>This error is occurring because Enterprise Security contains a "configuration_checker.py" modular input that attempts to alert you when misconfigurations are detected - we attempt to be proactive and alert to conditions that might be causing the application to misbehave.</P> <P>In this case, the intent of the alert is to alert when a scripted input or modular input has exited abnormally. The definition of "abnormally" that we use means "exited with a non-zero exit code".</P> <P>Sometimes, as in this case, this particular check backfires. The error you're seeing is benign and is occurring because the scripted inputs included with the TA-windows add-on use non-zero exit codes even when they exit successfully. This has been corrected in an upcoming version (which of course doesn't help in this instance).</P> <P>If you would like to just get rid of the message, you can disable this input stanza in the Manager:</P> <PRE><CODE>Settings --&gt; Data Inputs --&gt; Configuration Checker --&gt; confcheck_script_errors </CODE></PRE> <P>However, that would disable the exit status checking for ALL scripted and modular inputs on the system. If you'd like a more robust solution, reach out to support and mention this posting, and we can provide a small patch to the configuration_checker.py script which will deal with this in a more intelligent fashion - with the caveat that it wouldn't persist beyond an upgrade.</P> Fri, 21 Feb 2014 03:11:21 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Message/m-p/154187#M611 jervin_splunk 2014-02-21T03:11:21Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Message/m-p/154188#M612 <P>We are having this issue as well. Thanks for to clear answer to this problem. We will get a case open with support about it.</P> Wed, 26 Feb 2014 16:08:59 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Enterprise-Security-Message/m-p/154188#M612 delink 2014-02-26T16:08:59Z