I am getting this SyntaxError  while using the IPinfo Splunk App on my Splunk Enterprise instance. Environment Details: Splunk Version: 9.2.2 App Name: IPinfo Splunk App OS: Linux Problem Description: When running the ipinfo command in a search, the command fails. Upon inspecting the search.log, I found that the external search command is exiting with a SyntaxError. It appears the script ipinfo_command.py uses the assignment expression (Walrus Operator :=), which was introduced in Python 3.8. However, even on Splunk 9.2.2, the script is being invoked using the bundled Python 3.7 interpreter in my environment, leading to the following error: ERROR ChunkedExternProcessor - stderr: File "/opt/splunk/etc/apps/ipinfo_app/bin/ipinfo_command.py", line 139 ERROR ChunkedExternProcessor - stderr: ip_addresses = [v.strip() for f in fields if (v := record.get(f)) and v.strip()] ERROR ChunkedExternProcessor - stderr:                                                                   ^ ERROR ChunkedExternProcessor - stderr: SyntaxError: invalid syntax ERROR ChunkedExternProcessor - Error in 'ipinfo' command: External search command exited unexpectedly with non-zero error code 1. Can someone please help ? ... View more

 10-27-2025 03:21:21.006 WARN  AuthorizationManager [28813 MainThread] - Capability 'use_file_operator' is not recognized by Splunk. Ignoring... 10-27-2025 03:21:21.054 ERROR AuthenticationManager [28813 MainThread] - preserveStateDuringReload: Method not implemented 10-27-2025 03:21:21.134 ERROR SystemInfo [25968 RunDispatch] - Failed to read memory limit at location="V1:/sys/fs/cgroup/cpu,cpuacct:/:/sys/fs/cgroup/memory:/:" Could anyone please help fixing these error messages ? ... View more

I need to onboard Cisco Catalyst 8500 router logs into Splunk. When I was looking for addons, I found the below addons that seem relevant  Cisco Catalyst Add-on for Splunk - This is preferred as its Cisco built and supported. https://splunkbase.splunk.com/app/7538 Then there is this addon Add-on for Cisco Network Data - https://splunkbase.splunk.com/app/1467, but it is unsupported. The instructions in the Cisco built addon are not very clear on how to onboard the router logs.  Can someone please help? ... View more

I want to convert some of the below individual json objects in the event into nested single json object like the second example Current Format { "ID": 1, "Timestamp": "2023-05-18T05:07:59.940594300Z", "FileVersion": "10.0.17134.1 (WinBuild.160101.0800)", "Company": "Microsoft Corporation", "TerminalSessionId": 0, "UtcTime": "2018-08-20 15:18:59.929", "Product": "Microsoft® Windows® Operating System", } Expected Format { "ID": 1, "Timestamp": "2023-05-18T05:07:59.940594300Z", "EventData":{ "FileVersion": "10.0.17134.1 (WinBuild.160101.0800)", "Company": "Microsoft Corporation", "TerminalSessionId": 0, "UtcTime": "2018-08-20 15:18:59.929", "Product": "Microsoft® Windows® Operating System", } } I have tried to playaround with json functions but unable to figure out how to achieve the above outcome. Can someone please help ? ... View more