Hi,
In Splunk Enterprise v10.0.0, the following error is reported in "splunkd.log" ever minute.
- 09-18-2025 22:02:00.165 +0000 ERROR ExecProcessor [2560 ExecProcessor] - message from "/cloudmark/splunk/bin/python3.9 /cloudmark/splunk/etc/apps/search/bin/quarantine_files.py" File "/cloudmark/splunk/lib/python3.9/site-packages/splunk/clilib/cli_common.py", line 504, in getMgmtUri
- 09-18-2025 22:03:00.171 +0000 ERROR ExecProcessor [2560 ExecProcessor] - message from "/cloudmark/splunk/bin/python3.9 /cloudmark/splunk/etc/apps/search/bin/quarantine_files.py" File "/cloudmark/splunk/lib/python3.9/site-packages/splunk/clilib/cli_common.py", line 504, in getMgmtUri
I narrowed to issue to URI "https://[::1]:8089" written to run file: "/opt/splunk/var/run/splunk/splunkd_uri.txt". It looks like the python helper script "cli_common.py" is not properly parsing out the IPv6 address on the colon ':' delimiter. The temporary fix is to modify the URI to "https://127.0.0.1:8089", which resolves the ERROR. However, after restarting Splunkd, URI "https://[::1]:8089" is again written to run file "/opt/splunk/var/run/splunk/splunkd_uri.txt" and the ERROR reoccurs.
Looks like a fix is needed to python script "cli_common.py" but if the script file is changed, then the Splunk manifest check will complain.
Does anyone know of a permanent fix?
