Script Error xml.etree.ElementTree.ParseError

[PierrAlezOCD]

Hello,

We repeatedly receive this message when collecting information via the plugin:

2025-09-29 08:30:44,656 ERROR pid=1278370 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events.
Traceback (most recent call last):
File "/opt/splunk/etc/apps/BeyondTrust-RS-Integration/bin/beyondtrust_rs_integration/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events
self.collect_events(ew)
File "/opt/splunk/etc/apps/BeyondTrust-RS-Integration/bin/beyondtrust_rs_reporting_api_session_events.py", line 72, in collect_events
input_module.collect_events(self, ew)
File "/opt/splunk/etc/apps/BeyondTrust-RS-Integration/bin/input_module_beyondtrust_rs_reporting_api_session_events.py", line 56, in collect_events
session_tree = ET.fromstring(session_report)
File "/opt/splunk/lib/python3.9/xml/etree/ElementTree.py", line 1348, in XML
return parser.close()
xml.etree.ElementTree.ParseError: no element found: line 2061329, column 21

Do you have any ideas on how to fix this issue?

[livehybrid]

Hi @PierrAlezOCD 

It looks like the data is being received from BeyondTrust by the API because its referencing a specific line that is failing the xml function which makes me wonder if something is incorrect or changed in the events received from BeyondTrust which the app cannot handle.

Are you using the latest version of the app from Splunkbase?

You may be able to speak to BeyondTrust directly through your support channels with them as they state in the docs that they do support the Splunk app (https://docs.beyondtrust.com/rs/docs/splunk) 

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing