Hi Everyone,
Here is some context, one of our customers is using our Splunk App we created with the Add On builder. All it does is forward alerts into our platform and we use splunk.Intersplunk to get the search results.
The customer is getting the following error but we do not know why:
"07-11-2022 15:31:37.179 +0000 ERROR sendmodalert - action=bigpanda_alert STDERR - backports.configparser.MissingSectionHeaderError: File contains no section headers.","2022-07-11T11:31:37.179+0000","bigpanda_alert",,,,,,,,,,,,,,,sendmodalert,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,15,11,31,july,37,monday,2022,0,,,,,,,,,,,"action=bigpanda_alert STDERR - backports.configparser.MissingSectionHeaderError: File contains no section headers.","err0r nix-all-logs nix_errors splunk_modalert splunkd-log",,,,,,lpec5009spksh03,,,"_internal",,,,,,1,,ERROR,,,,,,,,,,,,,,,,,,,,"--_::._+___-_=__-__..:_____.",,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,,"/opt/splunk/var/log/splunk/splunkd.log",splunkd,,"URL-REDACTED-HERE",,,,,,,,,error,,,error,,,,,,29,,,0,,,,,,,,,,,,,,,,,
My initial suspicion is that it is related to enableheader being overriden in etc/system/default/command.conf with false, but I tried it on my instance and I got no errors.
Any insights into this would be greatly apreciated!
