Exec Process error

[fedayn05]

Hello everyone,

I have just deployed Splunk ES and I am getting a lot of these errors :

"Health Check: msg="A script exited abnormally with exit status: 1" input="./opt/splunk/etc/apps/DA-ESS-ThreatIntelligence/bin/threatmatch.py" stanza="threatmatch://registry_value_text""

I run the following SPL : index=_internal sourcetype=splunkd threatmatch.py and the results are : 

INFO ExecProcessor [2071531 ExecProcessor] - New scheduled exec process: /opt/splunk/bin/python3.9 /opt/splunk/etc/apps/DA-ESS-ThreatIntelligence/bin/threatmatch.py

Any idea please how can i resolve this , as it causes delayed searches for Splunk ES.

Thank you

[tscroggins]

Hi @fedayn05,

Which versions of Splunk Enterprise and Splunk Enterprise Security do you have installed?

Splunk Enterprise 9.0.1 deprecates and Splunk Enterprise 10.0 disables the REST API search/parser endpoint used by earlier versions of Splunk Enterprise Security to validate the data models used by the threatmatch modular input.

If you're running Splunk Enterprise 10.0, ensure you're also running Splunk Enterprise Security 7.3.4 or a later version of Splunk Enterprise Security compatible with Splunk Enterprise 10.0 and the v2 REST API.