https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-am-I-getting-script-failure-errors-with-configuration-check/m-p/454527#M6394 <P>I went through and disabled the scripted input as detailed <A href="https://answers.splunk.com/answers/128410/msg-a-script-exited-abnormally-input-splunk-home-etc-apps-splunk-ciscoips-bin-get-ips-feed-py-stanza-default-status-exited-with-code-1.html">here</A> and <A href="https://answers.splunk.com/answers/123207/enterprise-security-message.html">here</A>. The errors have since disappeared. Looks like this has been an issue since 2014, surprised it isn't resolved yet...</P> <P><CODE>Settings &gt; Data Inputs &gt; Configuration Checker &gt; confcheck_script_errors</CODE></P> Wed, 12 Sep 2018 17:18:49 GMT DEAD_BEEF 2018-09-12T17:18:49Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-am-I-getting-script-failure-errors-with-configuration-check/m-p/454526#M6393 <P>On new install of Splunk Enterprise Security (version 4.7.6), I am seeing the following errors, once an hour. I included a sample of the alerts but it triggers on 7 .sh files every hour on the hour.</P> <PRE><CODE>2018-09-11 16:00:00,385 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/openPortsEnhanced.sh" stanza="default" status="exited with code 1"" 2018-09-11 16:00:00,370 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/lsof.sh" stanza="default" status="exited with code 1"" 2018-09-11 16:00:00,355 ERROR pid=22425 tid=MainThread file=configuration_check.py:run:164 | status="completed" task="confcheck_script_errors" message="msg="A script exited abnormally" input="./bin/iostat.sh" stanza="default" status="exited with code 1"" </CODE></PRE> <P>Triggers on these scripts</P> <PRE><CODE>/bin/openPortsEnhanced.sh /bin/lsof.sh /bin/iostat.sh /bin/vmstat.sh /bin/time.sh /bin/cpu.sh /bin/bandwidth.sh </CODE></PRE> Tue, 11 Sep 2018 21:06:41 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-am-I-getting-script-failure-errors-with-configuration-check/m-p/454526#M6393 DEAD_BEEF 2018-09-11T21:06:41Z https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-am-I-getting-script-failure-errors-with-configuration-check/m-p/454527#M6394 <P>I went through and disabled the scripted input as detailed <A href="https://answers.splunk.com/answers/128410/msg-a-script-exited-abnormally-input-splunk-home-etc-apps-splunk-ciscoips-bin-get-ips-feed-py-stanza-default-status-exited-with-code-1.html">here</A> and <A href="https://answers.splunk.com/answers/123207/enterprise-security-message.html">here</A>. The errors have since disappeared. Looks like this has been an issue since 2014, surprised it isn't resolved yet...</P> <P><CODE>Settings &gt; Data Inputs &gt; Configuration Checker &gt; confcheck_script_errors</CODE></P> Wed, 12 Sep 2018 17:18:49 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/Why-am-I-getting-script-failure-errors-with-configuration-check/m-p/454527#M6394 DEAD_BEEF 2018-09-12T17:18:49Z