What do you mean, when a file is deleted? A file on an OS? If so what OS, and what auditing do you have for that OS? A file on Splunk? Splunk event data? ... View more

This has gone beyond what I had expected. Working with Doug Hurd and Cisco TAC, it has been determined that the app looks for the Python version that is installed on your Linux install and not what Splunk has installed. So I am running RHEL 6.9 which has Python version 2.6.6 and even with Splunk installed with Python version 2.7, it generates an error because the app or specifically the script splencore.sh is referencing the OS version of Python. I checked the Cisco script for CLI (encore.sh) and it specifically references the OS version. So to me, I see the app referencing the wrong place and somehow the version check needs to be redirected to the Splunk version. I hope that I was able to explain this properly so that it can be understood. If you have questions, don't hesitate to ask. Thank you. ... View more