Thanks to Jeremy for the details on this as I was able to get this working by following his instructions.  After upgrading to 9.0.1 I got the same error message "InvalidSSLConfiguration: Could not read private key attached....." but only on the 2nd server I upgraded. I happen to already have a PFX file we use for our wildcard certificate.  I deleted the PFX that was created from the upgrade and then deleted the certificate from windows store inside the Local Computer Certificates under Personal -> Certificates.  I manually imported my PFX into the Local Computer Certificates under Personal -> Certificates.   After that I stopped and started the splunkd service.  I checked the mongod log file (C:\Program Files\Splunk\var\log\Splunk) and everything looked fine.  I went back to the 1st server I had already successfully upgraded, and repeated the process.  The reason I repeated it on the first server is because of what Jeremy pointed out when you open the certificate by right clicking it and selecting all tasks-> Manage Private Keys you get the message "no keys found".  So even though the install succeeded, the certificate isn't complete. ... View more

The original configuration was completed by Splunk support with syslog-ng a little over a year ago.  I hadn't thought about using a different port for cisco devices but maybe that is something we could try.  I changed things up on the syslog-ng.conf file and then everything was routing into the ciscoios folder, including palo alto data which I didn't want to happen so I changed things back to the partially working conf file.           ... View more

So the except statement was corrected by editing the script, yes but then the script would not work in Splunk Enterpise but would work on another machine running python3.  It never worked in Splunk Enterprise until I changed from json to syslog.  Also it confused me that some of the script versions worked in Python2 and Python3 but not in Splunk Enterprise.  I really appreciate your help though and your questions helped me get to the solution.  ... View more

So the error that shows on the working Python3 code on Splunk Enterprise now is: JsonLineBreaker - JSON StreamId:17225535322107805233 had parsing error:Unexpected character while expecting '"': '\'' - data_source="C:\Program Files\Splunk\bin\scripts\NEW.py", data_host="splunkindexer1", data_sourcetype="_json" ... View more

On the other server when I run python -v I get Python 3.9.6.  I have gone through and modified the script to work in Python3 as a test but it's failing in Splunk Enterprise as well.  I will post the errors I'm getting. ... View more

So my Splunk enterprise is already set to version 3 and I'm using Splunk Enterprise version 8.0.5.  As I said in the original post the python script on a different machine works fine and it is using only version 3 on that server, and also from the command line directly on the Splunk server it is using 2.7.  Changing the enterprise config to force python version 2 on the splunk server could break all kinds of other things that I don't want to break.  And why would I need to change that when the script clearly works in both python 2.7 and python 3.  It just doesn't work on the Splunk Enterprise website.  So I'm at a loss on what to do.   ... View more

So I ran the command and it shows Python 2.7.17.  However both python 2.7 and 3.7 show up in the Splunk directory on the server. Is there a way to force version 2.7 on a script in Splunk Enterprise? ... View more

Yes I know the command can fail on various versions of python.  The problem is the command  "splunk cmd python scripts\test.py" is being run directly on the Splunk server which outputs the result fine.      ... View more