×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
jabezds
Path Finder
Member since: ‎07-06-2020
‎09-14-2023
Community Statistics
Posts 27
Solutions 1
Karma Given 2
Karma Received 2
Member Since ‎07-06-2020
Activity Feed
Topics I've Started
View All

Re: Moment.js not available in splunk 9.1.x+

by in Splunk Enterprise
‎09-14-2023 12:04 AM
1 Karma
‎09-14-2023 12:04 AM
1 Karma
http://...@b6436b649711.1/js/contrib/moment.js it seems moment.js is missing in this location , we verified in splunk 9.1.x+ this internal splunk file seems to be missing... ... View more

Why is moment.js not available in splunk 9.1.x+?

by in Splunk Enterprise
‎09-08-2023 03:32 AM
1 Karma
‎09-08-2023 03:32 AM
1 Karma
Hi, In the splunk 9.1.x version and above,  we are noticing that the moment.js is missing in the following location, /opt/splunk/share/splunk/search_mrsparkle/exposed/js/contrib/moment.js Due to this our custom app functionalities are not working and we are getting error as attached, Please let us know if this is a known issues and any resolutions for this. In spite of  placing the moment.js in our app folder we still notice the app is trying to use the default moment js in this location "/opt/splunk/share/splunk/search_mrsparkle/exposed/js/contrib/moment.js"  We have also tried other solution from the community by  placing  var moment = require('moment'); but still its returning error.  Can you please provide any possible  solution to resolve this issue. ... View more

Re: Error when importing custom python modules in ...

by in Splunk Enterprise
‎09-07-2023 03:22 AM
‎09-07-2023 03:22 AM
Traceback Part-2 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: rv = PersistentServerConnectionApplicationServer._load_file(filename) 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 57, in _load_file 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: m = imp.load_module(munged_name, filehandle, filename, data) 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/imp.py", line 234, in load_module 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: return load_source(name, filename, file) 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/imp.py", line 171, in load_source 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: module = _load(spec) 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "<frozen importlib._bootstrap>", line 696, in _load 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "<frozen importlib._bootstrap>", line 677, in _load_unlocked 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "<frozen importlib._bootstrap_external>", line 728, in exec_module 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/etc/apps/CustomApp/bin/umbrella_dashboard_api_client.py", line 13, in <module> 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: from logger import Logger 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: ModuleNotFoundError: No module named 'logger' 08-02-2023 16:15:01.806 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py:2: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses 08-02-2023 16:15:01.806 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: import imp 08-02-2023 16:15:01.808 +0530 ERROR HttpListener [77650 TcpChannelThread] - Exception while processing request from 127.0.0.1:37198 for /en-US/splunkd/__raw/servicesNS/nobody/CustomApp/umbrella?type=dns&from=1690929026000&to=1690972226000&_=1690972792547: Error starting: No module named 'logger' 08-02-2023 16:15:02.059 +0530 WARN PersistentScript [77745 PersistentScriptIo] - Process {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: PID 78587 exited with code 1 08-02-2023 16:15:02.059 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: Traceback (most recent call last): 08-02-2023 16:15:02.059 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 114, in <module> 08-02-2023 16:15:02.059 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: h.run() 08-02-2023 16:15:02.059 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/packet.py", line 191, in run 08-02-2023 16:15:02.059 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: self.handle_packet(in_packet) 08-02-2023 16:15:02.059 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/handle_loop.py", line 36, in handle_packet 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: self._current_handler = self.load(in_packet.command, in_packet.command_arg, in_packet.allow_stream()) 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 22, in load 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: class_and_meths = self._get_class_and_methods(command[0], stream_allowed) 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 31, in _get_class_and_methods 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: meths = self._cached_load_file(filename) 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 42, in _cached_load_file 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: rv = PersistentServerConnectionApplicationServer._load_file(filename) 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 57, in _load_file 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: m = imp.load_module(munged_name, filehandle, filename, data) 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/imp.py", line 234, in load_module 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: return load_source(name, filename, file) 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/imp.py", line 171, in load_source 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: module = _load(spec) 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "<frozen importlib._bootstrap>", line 696, in _load 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "<frozen importlib._bootstrap>", line 677, in _load_unlocked 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "<frozen importlib._bootstrap_external>", line 728, in exec_module 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/etc/apps/CustomApp/bin/umbrella_dashboard_api_client.py", line 13, in <module> 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: from logger import Logger 08-02-2023 16:15:02.060 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: ModuleNotFoundError: No module named 'logger' ... View more

Re: Error when importing custom python modules in ...

by in Splunk Enterprise
‎09-07-2023 03:20 AM
‎09-07-2023 03:20 AM
Traceback Part-1 08-02-2023 16:15:01.256 +0530 ERROR HttpListener [77650 TcpChannelThread] - Exception while processing request from 127.0.0.1:43332 for /en-US/splunkd/__raw/servicesNS/nobody/CustomApp/umbrella?type=dns&from=1690929026000&to=1690972226000&_=1690972792543: Error starting: No module named 'logger' 08-02-2023 16:15:01.493 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py:2: DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses 08-02-2023 16:15:01.493 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: import imp 08-02-2023 16:15:01.493 +0530 WARN PersistentScript [77745 PersistentScriptIo] - Process {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: PID 78576 exited with code 1 08-02-2023 16:15:01.493 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: Traceback (most recent call last): 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 114, in <module> 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: h.run() 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/packet.py", line 191, in run 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: self.handle_packet(in_packet) 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/handle_loop.py", line 36, in handle_packet 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: self._current_handler = self.load(in_packet.command, in_packet.command_arg, in_packet.allow_stream()) 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 22, in load 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: class_and_meths = self._get_class_and_methods(command[0], stream_allowed) 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 31, in _get_class_and_methods 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: meths = self._cached_load_file(filename) 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 42, in _cached_load_file 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: rv = PersistentServerConnectionApplicationServer._load_file(filename) 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 57, in _load_file 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: m = imp.load_module(munged_name, filehandle, filename, data) 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/imp.py", line 234, in load_module 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: return load_source(name, filename, file) 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/imp.py", line 171, in load_source 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: module = _load(spec) 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "<frozen importlib._bootstrap>", line 696, in _load 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "<frozen importlib._bootstrap>", line 677, in _load_unlocked 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "<frozen importlib._bootstrap_external>", line 728, in exec_module 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "<frozen importlib._bootstrap>", line 219, in _call_with_frames_removed 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/etc/apps/CustomApp/bin/umbrella_dashboard_api_client.py", line 13, in <module> 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: from logger import Logger 08-02-2023 16:15:01.494 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: ModuleNotFoundError: No module named 'logger' 08-02-2023 16:15:01.494 +0530 ERROR HttpListener [77650 TcpChannelThread] - Exception while processing request from 127.0.0.1:37186 for /en-US/splunkd/__raw/servicesNS/nobody/CustomApp/umbrella?type=dns&from=1690929026000&to=1690972226000&_=1690972792546: Error starting: No module named 'logger' 08-02-2023 16:15:01.641 +0530 WARN PersistentScript [77745 PersistentScriptIo] - Process {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: PID 78582 exited with code 1 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: Traceback (most recent call last): 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 114, in <module> 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: h.run() 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/packet.py", line 191, in run 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: self.handle_packet(in_packet) 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/handle_loop.py", line 36, in handle_packet 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: self._current_handler = self.load(in_packet.command, in_packet.command_arg, in_packet.allow_stream()) 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 22, in load 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: class_and_meths = self._get_class_and_methods(command[0], stream_allowed) 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 31, in _get_class_and_methods 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: meths = self._cached_load_file(filename) 08-02-2023 16:15:01.641 +0530 ERROR PersistentScript [77745 PersistentScriptIo] - From {/opt/splunk/bin/python3.7 /opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py}: File "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py", line 42, in _cached_load_file   ... View more

Re: Error when importing custom python modules in ...

by in Splunk Enterprise
‎09-07-2023 03:18 AM
‎09-07-2023 03:18 AM
@VatsalJagani  yes we are getting a full trace back, Its from our 3rd party app.         ... View more

Re: How to clear the kvstore contents at the begin...

by in Dashboards & Visualizations
‎09-05-2023 05:24 AM
‎09-05-2023 05:24 AM
@gcusello  Thanks for your response, is there a programmatic way of uploading an empty  lookup. Can you please help me with any documents or code.     ... View more

Why is there an Error when importing custom python...

by in Splunk Enterprise
‎09-05-2023 05:04 AM
‎09-05-2023 05:04 AM
Hi, while importing custom modules  (e.g. `from logger import Logger`) in the splunkd.log we are able to see  `ModuleNotFoundError: No module named 'logger'` error  and this is generated by this file "/opt/splunk/lib/python3.7/site-packages/splunk/persistconn/appserver.py" .We suspect somehow library is not able to identify internal modules and hence throwing error. We are also able to see warning `DeprecationWarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses` in same log file.  This issue seems to be on splunk version 9.0.x. For splunk version 8.2.x it is working fine. As we have noticed main difference in these 2 versions is python 2.7 support is removed from version 9.0.x. We will like to know the possible solution in solving this error. ... View more

How to clear the kvstore contents at the beginning...

by in Dashboards & Visualizations
‎08-21-2023 01:29 AM
‎08-21-2023 01:29 AM
Hi, We are working on developing a second version of the app. Our use-case is when the App is upgraded we need to clear the existing kvstore contents programmatically. And to NOTE we need to clear this kvstore only at the beginning of the app upgrade. It will be great if you can share some guidelines on achieving this.     ... View more
Labels

Re: Splunk Exam Results - Splunk Certified User 6....

by in Security
‎07-27-2023 07:52 AM
‎07-27-2023 07:52 AM
IM facing the same issue, didn't get my final results...how long did it take for you to get the results? ... View more

Failure in fetching Index names in SplunkCloud usi...

by in Splunk Cloud Platform
‎10-12-2022 04:13 AM
‎10-12-2022 04:13 AM
Hi , We are facing issues in listing available splunk indexes in SplunkCloud using  splunklib.client.connect provided by splunklib library. Below is the code snippet used: service = splunklib.client.connect(host=host, token=session_token) ind_list = service.indexes.list() This code works perfectly fine in the splunk enterprise and previous splunk cloud versions but noticed this issues happening on the latest versions (8.2.2202 and above). When this code executes on the 8.2.2202 and above we notices the following debug line, which clearly shows the timeout error while fetching the indexes as below: We see this timeout error because the splunk  is not returning the index names ,since it is failing to connect to splunk cloud. ERROR 2022-10-03 05:39:22,296 CiscoCloudSecurity : API: fetch_indexes, Exception : [Errno 110] Connection timed out Traceback (most recent call last): File "/opt/splunk/etc/apps/cisco-cloud-security/bin/fetch_indexes.py", line 26, in handle ind_list = service.indexes.list() File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/client.py", line 1479, in list return list(self.iter(count=count, **kwargs)) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/client.py", line 1438, in iter response = self.get(count=pagesize or count, offset=offset, **kwargs) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/client.py", line 1668, in get return super(Collection, self).get(name, owner, app, sharing, **query) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/client.py", line 766, in get **query) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/binding.py", line 290, in wrapper return request_fun(self, *args, **kwargs) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/binding.py", line 71, in new_f val = f(*args, **kwargs) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/binding.py", line 686, in get response = self.http.get(path, all_headers, **query) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/binding.py", line 1199, in get return self.request(url, { 'method': "GET", 'headers': headers }) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/binding.py", line 1259, in request response = self.handler(url, message, **kwargs) File "/opt/splunk/etc/apps/cisco-cloud-security/bin/splunklib/binding.py", line 1399, in request connection.request(method, path, body, head) File "/opt/splunk/lib/python3.7/http/client.py", line 1281, in request self._send_request(method, url, body, headers, encode_chunked) File "/opt/splunk/lib/python3.7/http/client.py", line 1327, in _send_request self.endheaders(body, encode_chunked=encode_chunked) File "/opt/splunk/lib/python3.7/http/client.py", line 1276, in endheaders self._send_output(message_body, encode_chunked=encode_chunked) File "/opt/splunk/lib/python3.7/http/client.py", line 1036, in _send_output self.send(msg) File "/opt/splunk/lib/python3.7/http/client.py", line 976, in send self.connect() File "/opt/splunk/lib/python3.7/http/client.py", line 1443, in connect super().connect() File "/opt/splunk/lib/python3.7/http/client.py", line 948, in connect (self.host,self.port), self.timeout, self.source_address) File "/opt/splunk/lib/python3.7/socket.py", line 728, in create_connection raise err File "/opt/splunk/lib/python3.7/socket.py", line 716, in create_connection sock.connect(sa) TimeoutError: [Errno 110] Connection timed out Please let us know how we can resolve this issue on cloud . Thanks.   ... View more

Re: Errors after Microsoft Azure Add on for Splunk...

by in All Apps and Add-ons
‎10-06-2022 02:54 AM
‎10-06-2022 02:54 AM
@jconger Thanks for the solution, Do you think reconfiguring the proxy settings on the Addon after the upgrade will also solve this issues?     ... View more

Re: How to resolve failures in app-inspect | check...

by in Splunk Enterprise
‎08-09-2022 03:35 AM
‎08-09-2022 03:35 AM
An update , We where asked to check if the below link is a possible solution.  https://stackoverflow.com/questions/59876585/npm-package-json-aliases-like-webpack  But as per the link we don't have the package.json file itself. So is there any another reason why im seeing this failure .Any suggestion is highly appreciated. Thanks. ... View more

Re: How to hold the table header, when using splun...

by in Splunk Enterprise
‎08-09-2022 12:28 AM
‎08-09-2022 12:28 AM
Thanks,  we tried various approaches, but this one worked for us. -->Override the splunk table CSS , with the below code change. Make sure to change the data view path according to your table #incidents_hash div [data-view="YOUR_DATA_VIEW_PATH"]{           overflow-y: auto !important;           height: 300px !important;        }         #incidents_hash div [data-view="YOUR_DATA_VIEW_PATH"] table{         border-collapse: collapse !important;           width: 10px !important;        }         #incidents_hash div [data-view="YOUR_DATA_VIEW_PATH"] th {           position: sticky !important;           text-align: left !important;           top: 0 !important;         } ... View more

Re: Why are Events getting split by splunk parser?

by in Splunk Enterprise
‎08-03-2022 03:16 AM
‎08-03-2022 03:16 AM
Thanks @richgalloway We tried this expression, btw I had to tweak the expression to  ([\r\n]+)\"\d{4}-\d\d , to accept the double quotes before the year, but im still facing the same issue. and the event is splitting exactly as the previous. Is there any other parameters i'm missing in props.conf?   ... View more

How to hold the table header when using Splunk JS?

by in Splunk Enterprise
‎07-26-2022 04:30 AM
‎07-26-2022 04:30 AM
We are working on a table creation, where in we are just passing the SPL query to the splunk JS, which populates the table in the UI. >My problem is that im not able to hold the table headers ,when scrolled it ,it does not stay. >Also if I scroll horizontally I have to go all the way to the end of the table layout to scroll horizontally. Any help or suggestion will help greatly.    Thanks, Jabez.   ... View more

Is there a way we can update the code for disablin...

by in Splunk Enterprise
‎07-26-2022 01:54 AM
‎07-26-2022 01:54 AM
Hi all, We have a case where we want to restrict a user from editing or updating  a input parameter . We have created a addon using Splunk's Add-on builder (v4.x), the addon takes couple of Data Input Parameters, which include a parameter that has to be disabled and should not be allowed to be updated. Is there a way we can update the code or does addon builder provide a option to perform such functionality? Any help or suggestions will be highly appreciated.   Thanks, Jabez. ... View more

How to fix failure in app-inspect | check_for_pyth...

by in Splunk Dev
‎07-26-2022 12:58 AM
‎07-26-2022 12:58 AM
Hi ,  Noticed this failure in the app inspect report(Version 2.22.0), Is there a way we can fix this on splunk cloud ? Below is the failure details in the report: Please check for inbound or outbound UDP network communications.Any programmatic UDP network communication is prohibited due to security risks in Splunk Cloud and App Certification.The use or instruction to configure an app using Settings -> Data Inputs -> UDP within Splunk is permitted. (Note: UDP configuration options are not available in Splunk Cloud and as such do not impose a security risk. File: bin/botocore/session.py Line Number: 204   Thanks, Jabez.   ... View more

How to resolve failures in app-inspect | check_hot...

by in Splunk Enterprise
‎07-26-2022 12:46 AM
‎07-26-2022 12:46 AM
Hi All,  We are facing a issue when running app inspect(version 2.22.0) report on our app, below is the failure we see: Embed all your app's front-end JS dependencies in the /appserver directory. If you import files from Splunk Web, your app might fail when Splunk Web updates in the future. Bad imports: ['moment'] File: /tmp/tmpylhrwm6y/cisco-cloud-security/appserver/static/vendor/chartjs/Chart.min.js Embed all your app's front-end JS dependencies in the /appserver directory. If you import files from Splunk Web, your app might fail when Splunk Web updates in the future. Bad imports: ['moment'] File: /tmp/tmpylhrwm6y/cisco-cloud-security/appserver/static/vendor/chartjs/Chart.js Embed all your app's front-end JS dependencies in the /appserver directory. If you import files from Splunk Web, your app might fail when Splunk Web updates in the future. Bad imports: ['moment'] File: /tmp/tmpylhrwm6y/cisco-cloud-security/appserver/static/vendor/daterangepicker/daterangepicker.min.js As per the error description we have placed all our Js dependencies under /appserver folder, but we still see this failure. Any help or suggestion are highly appreciated.   Thanks, Jabez. ... View more

Why are events getting split by Splunk parser?

by in Splunk Enterprise
‎07-22-2022 07:41 AM
‎07-22-2022 07:41 AM
HI, We are trying to process and  ingest  aws s3 events into splunk, but noticed few events are getting split, after checking the configuration we realized this should be caused by splunk internal parsing algorithm.  Please let us know if there is any issues in my configuration or could it be something related to splunk parser? Below is the entries on props and transform.conf: props--> [proxy] REPORT-proxylogs-fields = proxylogs_fields,extract_url_domain LINE_BREAKER = ([\r\n]+) # EVENT_BREAKER = ([\r\n]+) # EVENT_BREAKER_ENABLE = true SHOULD_LINEMERGE = false CHARSET = AUTO disabled = false TRUNCATE = 1000000 MAX_EVENTS = 1000000 EVAL-product = "Umbrella" EVAL-vendor = "xyz" EVAL-vendor_product = "abc" MAX_TIMESTAMP_LOOKAHEAD = 22 NO_BINARY_CHECK = true TIME_PREFIX = ^ TIME_FORMAT = %Y-%m-%d %H:%M:%S TZ = UTC   Transforms.conf --> [proxylogs_fields] DELIMS = "," FIELDS = Timestamp,policy_identities,src,src_translated_ip,dest,content_type,action,url,http_referrer,http_user_agent,status,requestSize,responseSize,responseBodySize,sha256,category,av_detection,pua,amp_disposition,amp_malwarename,amp_score,policy_identity_type,blocked_category,identities,identity_type,request_method,dlp_status,certificate_errors,filename,rulesetID,ruleID,destinationListID,s3_filename example of the events: "2022-06-27 08:57:14","wer.com","1.1.1.1","1.1.1.1","10.10.10.10","image/gif","ALLOWED","https://www.moug.net/img/btn_learning.gif","https://www.mikhgg.net/tech/woopr/0025.html","Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/102.0.5005.124 Safari/537.36 Edg/102.0.1245.44","200","","3571","3328","1a146b09676811234dddccd6dc0ee3cf11aa1803e774df17aa9a49a7370a40ec","Allow List,Fashion","","","","","","AD Users","","wer.com","AD Users,Network Tunnels","GET","ALLOWED","","btn_learning.gif","13347559","346105","15065619",2022-06-27-09-50-ade8.csv.gz   Events as seen in splunk:     ... View more

Does anyone have guidance on getting existing Add-...

by in Splunk Dev
‎04-19-2022 08:38 AM
‎04-19-2022 08:38 AM
Hi All, I'm trying to get my existing addon updated with the latest splunk add-on builder v4.We had developed the existing addon with a previous version of add-on builder , we got a information from the splunk team to rebuild the addon with latest builder. It will be of great help if you can provide me links on how this can be done, or any advise.   Thanks. ... View more
Labels

Capability admin_all_objects for accessing KVstore...

by in Splunk Dev
‎01-20-2021 10:58 PM
‎01-20-2021 10:58 PM
HI , I'm working on developing a app, I observed that the only capability available for a user to access or edit kvstore is using admin_all_object. Can you please suggest if there are any other capability to achieve this? As a admin we do not prefer giving users this capability(admin_all_object) just to access the kvstore.   Even if i give this capability the app inspect ,points out at this as an error. check_authorize_conf_admin_all_objects_privileges default/authorize.conf [role_cs_admin] contains `admin_all_objects = enabled`. File: default/authorize.conf Line Number: 16   ... View more
Labels

App Inspect Error-check_inputs_conf_spec_stanzas_h...

by in Splunk Dev
‎01-19-2021 07:16 AM
‎01-19-2021 07:16 AM
Hi, I am trying to validate my app with app inspect and im getting the following error, I have tried multiple solutions but couldn't get through. Extract from App Inspect [ Failure Summary ] Failures will block the Cloud Vetting. They must be fixed. check_inputs_conf_spec_stanzas_has_python_version_property Modular input "cloudlock" is defined in README/inputs.conf.spec, python.version should be explicitly set to python3 under each stanza. File: README/inputs.conf.spec Line Number: 1 Modular input "cloudlock_health_check" is defined in README/inputs.conf.spec, python.version should be explicitly set to python3 under each stanza. File: README/inputs.conf.spec Line Number: 4 Modular input "destination_lists_health_check" is defined in README/inputs.conf.spec, python.version should be explicitly set to python3 under each stanza. File: README/inputs.conf.spec Line Number: 7 Modular input "investigate_health_check" is defined in README/inputs.conf.spec, python.version should be explicitly set to python3 under each stanza. File: README/inputs.conf.spec Line Number: 10   Following is my configurations in  README/inputs.conf.spec [cloudlock://<name>] Log_Level = INFO [cloudlock_health_check://<name>] Log_Level = INFO [destination_lists_health_check://<name>] Log_Level = INFO [investigate_health_check://<name>] Log_Level = INFO   Following is my configurations in input.conf [cloudlock://incidents] disabled = 0 interval = 60 Log_Level = INFO python.version = python3 [cloudlock_health_check://health_check_cloudlock_batch_job] disabled = 0 interval = 600 Log_Level = INFO python.version = python3 [destination_lists_health_check://health_check_destination_lists_batch_job] disabled = 0 interval = 600 Log_Level = INFO python.version = python3 [investigate_health_check://health_check_investigate_batch_job] disabled = 0 interval = 600 Log_Level = INFO python.version = python3   Please help me with a solution . ... View more
Labels

Re: What is the most efficent way to do partial ma...

by in Splunk Search
‎09-11-2020 06:14 AM
‎09-11-2020 06:14 AM
Hi frbuser ,uhaq,gcusello,DavidHourani Where you able to get a optimized approach?,Im also searching for a solution to optimize rather than search with  * . eg ..category=Blogs,Software/Technology,Malware,Block List,Computer Security i want to search if only malware is available as a substring Im using this SPL -->index=abc category="*malware*"| stats count by category Can i make it more optimized?   Thanks in Advance. Jbz ... View more

Re: Splunk App Packaging: How to package app with ...

by in Getting Data In
‎08-02-2020 04:13 AM
‎08-02-2020 04:13 AM
Hi @m_zaman ,where you able to combine all the add-ons and app in one .spl file. Please let us know your approach ?   Many Thanks, Jabez ... View more

SPL to return list of field values for a particula...

by in Splunk Search
‎07-28-2020 06:37 PM
‎07-28-2020 06:37 PM
Hi All, I need a spl which will return the list of filenames that came for the latest time . | eval latest_time = max(strftime(_time,"%Y-%m-%d")) | stats count by latest_time,filename But im not able to achieve that through the above spl. eg Latest_time             filename 2020-07-28             filename1.txt                                       filename2.txt                                       filename3.txt                                       filename4.txt ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎09-14-2023 09:37 AM
Karma from
View All
Karma given to
View All