Splunk Enterprise Security

Splunk Enterprise Security: Streaming XML data tag "error"

tjgamez
New Member

Hi all,

I am new to Splunk and am still trying to figure out everything one step at a time. I have an issue where the streaming XML data is expecting a tag and is instead receiving something else. The warning that shows up in splunkd.log is the following:

WARN  ExecProcessor - Streaming XML data: Expected tag "event", instead received "error".

Is anyone familiar with this issue? And if so, where do I even start to troubleshoot it? I don't know what file to go to check the tags or the error.

Any help would be gladly appreciated. Thanks in advance!

0 Karma

jbrocks
Communicator

I guess you installed the Splunk CIM Addon? In this case, about all Events containing the word "error" or similar words will get the tag "error". This is defined by a serach in the eventtypes.conf of the Splunk CIM AddOn:

[err0r]
search = NOT sourcetype=stash (error OR failure OR fail OR failed OR fatal) NOT "not an error"
#tag   = error

and tags.conf:

## error
[eventtype=err0r]
error = enabled
0 Karma

tjgamez
New Member

Sorry for the late reply, so the way to fix it would be by disabling the error tag?

0 Karma

markhill1
Path Finder

I wouldnt disable the tag, you may prevent results appearing from important queries.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...