Greetings and thank you for raising the questions and to @jorritf  for a quick response.  I'm encountering similar issues unfortunately when attempting to collect Defender ATP telemetry.  I had upgraded to Splunk 8.1.1 and think there may be some issues going on with Python versions after the upgrade.  There was another Splunk Answers post about adding a stanza to set the python version but this didn't help out.   On the heavy forwarder, when attempting to view the configuration tabs in the app, I get the "spinning wheel of doom" and no log file from the app is generated from the path below.  I hope I'm not butting into the original post, but feel the issues could be related and would like to help if possible. I was able to catch this error from /opt/splunk/var/log//splunk/splunkd.log when accessing the app if this may help: ERROR ScriptRunner - stderr from '/opt/splunk/bin/python3.7 /opt/splunk/bin/runScript.py setup': File "/opt/splunk/etc/apps/TA-defender-atp-hunting/bin/ta_defender_atp_hunting/splunktaucclib/rest_handler/endpoint/validator.py", line 388 ... View more