Really intrigued by the notion of this app; installs great but have been getting a "Could not connect to REST API. Status 500" error in the app when uploading an ARF .xml file generated by CIS-CAT Assessor Pro v4.59.0.
Have replicated on Splunk Enterprise 9.4.9 and 10.0.2 running on Debian 13 with no SSL certificate; CIS-CAT Assessor running on Windows, and xml files uploded via Edge or Firefox. Nothing in the Splunk python.log file, text from splunkd.log as follows:
ERROR AdminManagerExternal [14726 TcpChannelThread] - Stack trace from python handler:\nTraceback (most recent call last):\n File "/opt/splunk/lib/python3.9/site-packages/splunk/admin.py", line 154, in init\n hand = handler(mode, ctxInfo)\n File "/opt/splunk/lib/python3.9/site-packages/splunk/admin.py", line 497, in __init__\n xmlData = et.fromstring(dataFromSplunkd)\n File "/opt/splunk/lib/python3.9/site-packages/splunk/safe_lxml_etree.py", line 74, in fromstring\n rootelement = etree.fromstring(text, parser=parser, base_url=base_url)\n File "src/lxml/etree.pyx", line 3264, in lxml.etree.fromstring\n File "src/lxml/parser.pxi", line 1989, in lxml.etree._parseMemoryDocument\n File "src/lxml/parser.pxi", line 1876, in lxml.etree._parseDoc\n File "src/lxml/parser.pxi", line 1164, in lxml.etree._BaseParser._parseDoc\n File "src/lxml/parser.pxi", line 633, in lxml.etree._ParserContext._handleParseResultDoc\n File "src/lxml/parser.pxi", line 743, in lxml.etree._handleParseResult\n File "src/lxml/parser.pxi", line 672, in lxml.etree._raiseParseError\n File "<string>", line 123759\nlxml.etree.XMLSyntaxError: xmlSAX2Characters: huge text node, line 123759, column 164\n
03-02-2026 19:38:54.822 +0000 ERROR AdminManagerExternal [14726 TcpChannelThread] - Unexpected error "<class 'lxml.etree.XMLSyntaxError'>" from python handler: "xmlSAX2Characters: huge text node, line 123759, column 164 (<string>, line 123759)". See splunkd.log/python.log for more details.
