Splunk Enterprise

ERROR ExecProcessor cli_common.py", line 504, in getMgmtUri

ocnsinc
New Member

Hi,

In Splunk Enterprise v10.0.0, the following error is reported in "splunkd.log" ever minute.

  • 09-18-2025 22:02:00.165 +0000 ERROR ExecProcessor [2560 ExecProcessor] - message from "/cloudmark/splunk/bin/python3.9 /cloudmark/splunk/etc/apps/search/bin/quarantine_files.py" File "/cloudmark/splunk/lib/python3.9/site-packages/splunk/clilib/cli_common.py", line 504, in getMgmtUri
  • 09-18-2025 22:03:00.171 +0000 ERROR ExecProcessor [2560 ExecProcessor] - message from "/cloudmark/splunk/bin/python3.9 /cloudmark/splunk/etc/apps/search/bin/quarantine_files.py" File "/cloudmark/splunk/lib/python3.9/site-packages/splunk/clilib/cli_common.py", line 504, in getMgmtUri

I narrowed to issue to URI "https://[::1]:8089" written to run file: "/opt/splunk/var/run/splunk/splunkd_uri.txt".  It looks like the python helper script "cli_common.py" is not properly parsing out the IPv6 address on the colon ':' delimiter.  The temporary fix is to modify the URI to "https://127.0.0.1:8089", which resolves the ERROR.  However, after restarting Splunkd, URI "https://[::1]:8089" is again written to run file       "/opt/splunk/var/run/splunk/splunkd_uri.txt" and the ERROR reoccurs.

Looks like a fix is needed to python script "cli_common.py" but if the script file is changed, then the Splunk manifest check will complain.

Does anyone know of a permanent fix?      

Labels (2)
0 Karma

livehybrid
SplunkTrust
SplunkTrust

Hi @ocnsinc 

As this is an issue with a built-in script you are right that the manifest will complain about the change and also it will be overwritten in the future if you upgrade. I think the best thing to do raise with Splunk Support and hopefully they will raise a bug and get it resolved in a future release.

Head over to https://www.splunk.com/support to raise a support case.

🌟 Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...