Just installed splunk 9.0.1 on an Ubuntu server and received an influx of internal errors in splunkd.log saying the following:
"message from "/opt/splunk/bin/python3.7 /opt/splunk/etc/apps/splunk_assist/bin/uiassets_modular_input.py" splunk.LicenseRestriction: [HTTP 402] Current license does not allow the requested action"
What exactly is the forwarder trying to do that is causing this error to show? I've also attempted to add an enterprise license but receive the same error.
I'm seeing similar messages in my local Splunk install which is version 9.0.3. Additionally, the Splunk UI message looks like:
Missing or malformed messages.conf stanza for MOD_INPUT:INIT_FAILURE__modinput_eventgen_the app "SA-Eventgen"_Introspecting scheme=modinput_eventgen: script running failed (exited with code 1).2/1/2023, 12:58:23 PM