So I just upgraded to Splunk Enterprise 10.2.0 and Stream stopped working. After some digging through the logs I found two separate issues, both caused by Python 3.13 compatibility problems. Sharing the fixes here in case anyone else hits this. What I saw in the logs First error: AttributeError: 'RawConfigParser' object has no attribute 'readfp'. Did you mean: 'read'? Second error:   /opt/splunk/etc/apps/splunk_app_stream/appserver/controllers/captureipaddresses.py cannot be executed by Python: module 'collections' has no attribute 'MutableSet'   What's going on Splunk 10.2.0 ships with Python 3.13, which removed some APIs that have been deprecated: RawConfigParser.readfp() was removed in Python 3.12 collections.MutableSet was removed in Python 3.10 The second error is a bit tricky — I wasted some time looking through captureipaddresses.py for MutableSet and found nothing. Turns out the real culprit is a bundled library that the controller imports: /opt/splunk/lib/python3.13/site-packages/IPy.py. The fixes 1. Fix stream_utils.py   cp /opt/splunk/etc/apps/splunk_app_stream/bin/splunk_app_stream/utils/stream_utils.py \ /opt/splunk/etc/apps/splunk_app_stream/bin/splunk_app_stream/utils/stream_utils.py.bak sed -i 's/config\.readfp/config.read_file/g' \ /opt/splunk/etc/apps/splunk_app_stream/bin/splunk_app_stream/utils/stream_utils.py 2. Fix IPy.py   cp /opt/splunk/lib/python3.13/site-packages/IPy.py \ /opt/splunk/lib/python3.13/site-packages/IPy.py.bak sed -i 's/collections\.MutableSet/collections.abc.MutableSet/g' \ /opt/splunk/lib/python3.13/site-packages/IPy.py Then restart Splunk web:   /opt/splunk/bin/splunk restart splunkweb     These are patches to Splunk-bundled files, so they could get overwritten on the next upgrade. Make a note to re-check after any Splunk or Stream app update. Hopefully Splunk ships a proper fix soon. Hope this saves someone a few hours of head-scratching! ... View more

I am trying to run the following tstats search on indexer cluster, recently updated to splunk 8.2.1:     | tstats count where index=_internal by host       The search returns no results, I suspect that the reason is this message in search log of the indexer:     Mixed mode is disabled, skipping search for bucket with no TSIDX data: \opt\splunkhot\_internaldb\db\hot_v1_4334       When I check the specified bucket folder, I can see the tsidx files inside.  Interesting fact is, that this issue occurs only with _internal index, same command works fine with other indexes. I have datamodel "Splunk's Internal Server Logs" enabled and accelerated. Any suggestions where to start troubleshooting this issue? ... View more

We made a clean installation of on-prem Splunk Enterprise 8.0.9 and Enterprise Security 6.4.0. When correlation search returns results, we would like to append these results to an email via adaptive response action "Send Email".  We had selected the option to include an inline-table, but regardless of this setting, the table with results is still not added to the email. There are two additional  findings we discovered: If we try to append results of standard alert search (non-correlation search) to an email it works. If we set sendresults = 1 in $SPLUNK_HOME/etc/system/local/alert_actions.conf it also works but not for all correlation searches... Has anybody encountered such problems and how did you solve it? ... View more