All Apps and Add-ons

Security Essentials CIM Compliance Check error

BrendanCO
Path Finder

Hello. I've recently installed Security Essentials within my Spunk instance that is receiving Palo Alto, Cisco switch and Active Directory log files. I can see all the data just fine in each respective app. Each of their data models is accelerated. 

I've installed the CIM, accelerated the relevant data models, set up Security Essentials and then go to the CIM Compliance Check and I get the following error:

Error in 'sseidenrichment' command: External search command exited unexpectedly with non-zero error code 1

Thoughts?

 

Labels (1)
Tags (1)
0 Karma

_joe
Path Finder

This ended up being a big within the app, resolved in Version 3.3.1


March 10, 2021
This is a small release with the following bugs fixed:
- Local search mapping mapped to wrong field when using Create New from Content Introspection
- Fixed a bug where the update would fail based on the data returned
- Modified the links to remediate a potential tabnabbing vulnerability
- Removed the Highcharts library
- Fixed a bug with the sseidenrichment command (Only affects Splunk 8.1)

0 Karma

_joe
Path Finder

I am having a similar issue with any search using the sseidenrichment command. I wanted to additionally comment that, for me at least, this issue started when we upgraded from Splunk 8.0 to 8.1.2. I have not been able to identify a root cause yet. Is anyone else noticing a correlation between this issue and Splunk version 8.1?

0 Karma

BrendanCO
Path Finder

I know that there is a Python 3 upgrade we need to be sure we've addressed: 
https://docs.splunk.com/Documentation/Splunk/latest/Python3Migration/AboutMigration

 

0 Karma

Suirand1
Loves-to-Learn Everything

I am having the same situation with the same error message.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!