Hi.  Looking for suggestions or for an updated version of the add-on https://splunkbase.splunk.com/app/7448 We deployed the add-on and have a successful connection but we get errors attempting to create a report. We suspect that the API has changed since the add-on was developed. Here's an excerpt from the logs: 2026-06-16 10:59:37,348 log_level=ERROR pid=3505126 tid=MainThread file=base_modinput.py:log_error:309 | Get error when collecting events. Traceback (most recent call last):   File "/opt/splunk/etc/apps/TA-wiz-discovered-vms/bin/ta_wiz_discovered_vms/aob_py3/modinput_wrapper/base_modinput.py", line 128, in stream_events self.collect_events(ew)   File "/opt/splunk/etc/apps/TA-wiz-discovered-vms/bin/wiz_virtual_machines.py", line 76, in collect_events input_module.collect_events(self, ew)   File "/opt/splunk/etc/apps/TA-wiz-discovered-vms/bin/input_module_wiz_virtual_machines.py", line 193, in collect_events report_id = create_cloud_resource_inventory_report(helper, url, token, project_id, rn)   File "/opt/splunk/etc/apps/TA-wiz-discovered-vms/bin/input_module_wiz_virtual_machines.py", line 88, in create_cloud_resource_inventory_report rid = response.json()['data']['createReport']['report']['id'] TypeError: 'NoneType' object is not subscriptable 2026-06-16 10:59:37,346 log_level=DEBUG pid=3505126 tid=MainThread file=connectionpool.py:_make_request:474 | https://api.us17.app.wiz.io:443 "POST /graphql HTTP/1.1" 200 None 2026-06-16 10:59:37,131 log_level=DEBUG pid=3505126 tid=MainThread file=connectionpool.py:_new_conn:1021 | Starting new HTTPS connection (1): api.us17.app.wiz.io:443 2026-06-16 10:59:37,130 log_level=INFO pid=3505126 tid=MainThread file=base_modinput.py:log_info:295 | Creating report: from_Splunk_TA-wiz-discovered-vms_splunkhf4_the_wiz_discovered_vms_1781621976. Filter projectId=* 2026-06-16 10:59:37,130 log_level=INFO pid=3505126 tid=MainThread file=base_modinput.py:log_info:295 | Report creation phase begins here... 2026-06-16 10:59:37,129 log_level=INFO pid=3505126 tid=MainThread file=base_modinput.py:log_info:295 | Access token for rt2dlz...h2w5xg was successfully obtained. 2026-06-16 10:59:37,128 log_level=DEBUG pid=3505126 tid=MainThread file=connectionpool.py:_make_request:474 | https://auth.app.wiz.io:443 "POST /oauth/token HTTP/1.1" 200 None 2026-06-16 10:59:36,522 log_level=DEBUG pid=3505126 tid=MainThread file=connectionpool.py:_new_conn:1021 | Starting new HTTPS connection (1): auth.app.wiz.io:443 2026-06-16 10:59:36,521 log_level=INFO pid=3505126 tid=MainThread file=base_modinput.py:log_info:295 | Obtaining access token for rt2dlz...h2w5xg... 2026-06-16 10:59:36,521 log_level=INFO pid=3505126 tid=MainThread file=base_modinput.py:log_info:295 | Wiz authentication begins here... 2026-06-16 10:59:36,520 log_level=INFO pid=3505126 tid=MainThread file=base_modinput.py:log_info:295 | Logging level is set to: DEBUG The error "TypeError: 'NoneType' object is not subscriptable" suggests that the ad-on Python script is getting no results back from the call 'create_cloud_resource_inventory_report'.  Possibly the Wiz API has changed? Suggestions welcome. --staten ... View more

How can we resolve some errors when restarting splunkd on our Splunk ES search-head?: Invalid key in stanza [sendtoplaybook] in /opt/splunk/etc/apps/TA-threatconnect/default/alert_actions.conf, line 6: param.playbook_endpoint (value: ). Invalid key in stanza [sendtoplaybook] in /opt/splunk/etc/apps/TA-threatconnect/default/alert_actions.conf, line 7: param.fields (value: ). Value in stanza [sourcetype=sendtoplaybook:results] in /opt/splunk/etc/apps/TA-threatconnect/default/tags.conf, line 1 not URL encoded: sourcetype = sendtoplaybook:results TA-threatconnect/default/alert_actions.conf is causing the Adaptive Response Actions menu to malfunction on our Splunk ES search-head. To recreate: Open Enterprise Security -> Configure -> Content Management -> Select a Correlation Search to Edit -> Scroll to bottom of page. Issues: Under "Adaptive Response Actions", selections " Risk Analysis" and "Notable" are missing. Selecting "+ Add New Response Action" opens an empty selection menu. Removing TA-threatconnect/default/alert_actions.conf mitigates the splunk startup errors and the Adaptive Response Actions menu malfunction. Any suggestions and/or fixes are welcome. ... View more

Looking for insights as to what's the source of some errors we're seeing with DUO Splunk Connector. We installed the app on a heavy-forwarder and it's generally working. However, we're seeing several of these errors in splunkd.log: ERROR JsonLineBreaker - JSON StreamId:11840170364389813249 had parsing error:Unexpected character while looking for value: '<' - data_source="duo", data_host="duo_api", data_sourcetype="json" Any suggestions? ... View more

How might one obtain a list of all the Windows domain members a specific user is currently logged in to? Our domain controllers have Splunk UF with Splunk_TA_windows and Splunk_TA_microsoft_ad add-ons, and we're running both Splunk Enterprise as well as Splunk Enterprise Security. Thanks for any suggestions. ... View more

Hi, we've been successfully running this add-on on a heavy-forwarder (HF) for a while. The add-on connects to tap-api-v2.proofpoint.com every 10 minutes. Starting yesterday (Sunday), ProofPooint_TAP_SIEM logs stopped getting indexed. splunkd.log on our HF running this add-on reports an error. We went from this: 12-02-2018 10:31:05.412 -0500 INFO ExecProcessor - message from "python /opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/proofpoint_tap_siem.py" proofpoint_tap_siem://Proofpoint: query_and_save/Successful query from 2018-12-02T15:21:05Z to 2018-12-02T15:31:04Z to this: 12-02-2018 10:41:04.836 -0500 ERROR ExecProcessor - message from "python /opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/proofpoint_tap_siem.py" proofpoint_tap_siem://Proofpoint: stream_events/[Errno 111] Connection refused The firewall logs indicate that this HF is no longer connecting to the API server at this point. And this appears to be confirmed by running tcpdump on the HF, where we see no connection attempts to dst 148.163.148.173 or dst 148.163.152.173. How can we enable debugging to troubleshoot this issue? Thanks. ... View more

I'm trying to use the "Add-On for MAC Lookup " and it errors with 'command="maclookup", : failed to use the netaddr module!' For example, my Splunk search produces a table with 1 entry: dest_hostname dest_nt_host dest_ip dest_mac dest_subnet_name android-1fe665ec066a8cdd android-1fe665ec066a8cdd.home 10.1.1.99 dc:44:b6:99:f9:a5 Guest-Wifi whereupon I invoke maclookup: ... | table dest_hostname, dest_nt_host, dest_ip, dest_mac, dest_subnet_name | maclookup field=dest_mac ... resulting in: command="maclookup", : failed to use the netaddr module! No results found. Enabling debug, I see the following in maclookup.log: 2018-11-26 15:39:55,142 INFO maclookup:139 - using mac to lookup : dc:44:b6:99:f9:a5 2018-11-26 15:39:55,142 INFO maclookup:141 - netaddr lookup: DC-44-B6-99-F9-A5 ... 2018-11-26 15:39:55,224 ERROR maclookup:154 - failed to use the netaddr module! I've restarted splunkd on this system (RHEL 7.5) a few times, and even rebooted the server, but that hasn't made a difference. It seems that this error is the result of an OEM vendor not being found in the netaddr lookup. When I manually paste the MAC addr dc:44:b6:99:f9:a5 into https://www.macvendorlookup.com/ , the site returns: Company: No Vendor Exists When the table includes a different MAC addr, netaddr may give no error. For example, if the table includes: dest_hostname dest_nt_host dest_ip dest_mac dest_subnet_name ETs-Phone ETs-Phone.home 10.1.1.50 00:56:cd:95:16:62 Guest-Wifi ... maclookup gives no error. When I manually paste the MAC addr 00:56:cd:95:16:62 into https://www.macvendorlookup.com/ , the site returns: Company: Apple, Inc. This leads me to the question of whether we can get this add-on to use a different site, such as https://www.wireshark.org/tools/oui-lookup.html Thanks. ... View more