All Apps and Add-ons

AdminManagerExternal error

Steve_S
New Member

Really intrigued by the notion of this app; installs great but have been getting a "Could not connect to REST API. Status 500" error in the app when uploading an ARF .xml file generated by CIS-CAT Assessor Pro v4.59.0.

Have replicated on Splunk Enterprise 9.4.9 and 10.0.2 running on Debian 13 with no SSL certificate; CIS-CAT Assessor running on Windows, and xml files uploded via Edge or Firefox. Nothing in the Splunk python.log file, text from splunkd.log as follows:

ERROR AdminManagerExternal [14726 TcpChannelThread] - Stack trace from python handler:\nTraceback (most recent call last):\n  File "/opt/splunk/lib/python3.9/site-packages/splunk/admin.py", line 154, in init\n    hand = handler(mode, ctxInfo)\n  File "/opt/splunk/lib/python3.9/site-packages/splunk/admin.py", line 497, in __init__\n    xmlData = et.fromstring(dataFromSplunkd)\n  File "/opt/splunk/lib/python3.9/site-packages/splunk/safe_lxml_etree.py", line 74, in fromstring\n    rootelement = etree.fromstring(text, parser=parser, base_url=base_url)\n  File "src/lxml/etree.pyx", line 3264, in lxml.etree.fromstring\n  File "src/lxml/parser.pxi", line 1989, in lxml.etree._parseMemoryDocument\n  File "src/lxml/parser.pxi", line 1876, in lxml.etree._parseDoc\n  File "src/lxml/parser.pxi", line 1164, in lxml.etree._BaseParser._parseDoc\n  File "src/lxml/parser.pxi", line 633, in lxml.etree._ParserContext._handleParseResultDoc\n  File "src/lxml/parser.pxi", line 743, in lxml.etree._handleParseResult\n  File "src/lxml/parser.pxi", line 672, in lxml.etree._raiseParseError\n  File "<string>", line 123759\nlxml.etree.XMLSyntaxError: xmlSAX2Characters: huge text node, line 123759, column 164\n
03-02-2026 19:38:54.822 +0000 ERROR AdminManagerExternal [14726 TcpChannelThread] - Unexpected error "<class 'lxml.etree.XMLSyntaxError'>" from python handler: "xmlSAX2Characters: huge text node, line 123759, column 164 (<string>, line 123759)". See splunkd.log/python.log for more details.

 

Labels (1)
0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Splunk Community Badges!

  Hey everyone! Ready to earn some serious bragging rights in the community? Along with our existing badges ...

[Puzzles] Solve, Learn, Repeat: Matching cron expressions

This puzzle (first published here) is based on matching timestamps to cron expressions.All the timestamps ...