All Apps and Add-ons

How to troubleshoot error "File contains no section headers" for the SA-SPLICE app?

jlockie
New Member

I am getting the following in our Splice logs

05-21-2015 11:10:57.421 -0700 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\SA-Splice\bin\taxii.py"" '\xef\xbb\xbf\n'
05-21-2015 11:10:56.919 -0700 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\SA-Splice\bin\taxii.py"" file: C:\Program Files\Splunk\etc\apps\SA-Splice\local\splice.conf, line: 1
05-21-2015 11:10:56.919 -0700 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\SA-Splice\bin\taxii.py"" ERRORFile contains no section headers.

I have MongoDB configured, and I can connect remotely using mongo.exe without credentials. I created the database "SPLICE" and I have the Splice app configured as such: mongodb://localhost:27017/SPLICE (mongodb is running on my Splunk server).
The IOC feed I am trying to connect to is the built-in "hailataxii" feed.

Does anyone have the first clue about these errors? Is this because I am running Splice in a Splunk Windows environment?

Tags (1)
0 Karma
1 Solution

cleroux_splunk
Splunk Employee
Splunk Employee

Splice has not been tested in Windows environment - it doesn't necessarily means that it doesn't works in such environments, just we don't know for sure!

According to the error I'm seeing here (File contains no section headers), make sure your splice.conf has the following format:

[splice]
mongo_connection_uri = mongodb://localhost:27017/splice

View solution in original post

cleroux_splunk
Splunk Employee
Splunk Employee

Splice has not been tested in Windows environment - it doesn't necessarily means that it doesn't works in such environments, just we don't know for sure!

According to the error I'm seeing here (File contains no section headers), make sure your splice.conf has the following format:

[splice]
mongo_connection_uri = mongodb://localhost:27017/splice

jlockie
New Member

Thanks. I ended up loading in Linux and Splice worked much better after that.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...