This repository was archived by the owner on May 20, 2025. It is now read-only.
Description We deployed 6.1.0 on SH in Splunk Cloud. I replicated config from my sandbox instance, which works fine. In Splunk Cloud it terminates with exception:
04/01/2022
04:22:58.679
2022-01-04 04:22:58,679 DEBUG pid=32448 tid=MainThread file=geoipupdate.py:stream_events:242 | Modular input completed
04/01/2022
04:22:58.679
2022-01-04 04:22:58,679 INFO pid=32448 tid=MainThread file=geoipupdate.py:stream_events:236 | Completed Request
04/01/2022
04:22:58.675
NameError: name 'CalledProcessError' is not defined
04/01/2022
04:22:58.675
except CalledProcessError as e:
04/01/2022
04:22:58.675
File "/opt/splunk/etc/apps/SecKit_SA_geolocation/bin/SecKit_SA_geolocation_rh_updater.py", line 124, in post_update
04/01/2022
04:22:58.675
Traceback (most recent call last):
04/01/2022
04:22:58.675
During handling of the above exception, another exception occurred:
04/01/2022
04:22:58.675
subprocess.CalledProcessError: Command '['$SPLUNK_HOME/etc/apps/SecKit_SA_geolocation/bin/geoipupdate/linux_amd64/geoipupdate -v -d /opt/splunk/etc/apps/SecKit_SA_geolocation/data/ -f /tmp/GeoIPk0dr5sqd.conf']' returned non-zero exit status 1.
04/01/2022
04:22:58.675
output=stdout, stderr=stderr)
04/01/2022
04:22:58.675
File "/opt/splunk/lib/python3.7/subprocess.py", line 512, in run
04/01/2022
04:22:58.675
**kwargs).stdout
04/01/2022
04:22:58.675
File "/opt/splunk/lib/python3.7/subprocess.py", line 411, in check_output
04/01/2022
04:22:58.675
stderr=subprocess.STDOUT,
04/01/2022
04:22:58.675
File "/opt/splunk/etc/apps/SecKit_SA_geolocation/bin/SecKit_SA_geolocation_rh_updater.py", line 122, in post_update
04/01/2022
04:22:58.675
Traceback (most recent call last):
04/01/2022
04:22:58.675
2022-01-04 04:22:58,675 ERROR pid=32459 tid=MainThread file=SecKit_SA_geolocation_rh_updater.py:post_update:157 | Exception generated when attempting to backup a lookup file
04/01/2022
04:22:57.741
2022-01-04 04:22:57,741 INFO pid=32459 tid=MainThread file=SecKit_SA_geolocation_rh_updater.py:post_update:82 | Trying to update
04/01/2022
04:22:57.741
2022-01-04 04:22:57,741 INFO pid=32459 tid=MainThread file=SecKit_SA_geolocation_rh_updater.py:post_update:77 | Asked to update id=xxxxxx token=XXXXXXXXXXXXX db=GeoLite2-Country GeoLite2-City GeoLite2-ASN
04/01/2022
04:22:57.741
2022-01-04 04:22:57,741 INFO pid=32459 tid=MainThread file=SecKit_SA_geolocation_rh_updater.py:post_update:76 | Asked to update <seckit_helpers.rest_handler.RequestInfo object at 0x7f2599c95810>
04/01/2022
04:22:57.741
2022-01-04 04:22:57,741 INFO pid=32459 tid=MainThread file=SecKit_SA_geolocation_rh_updater.py:post_update:74 | Asked to update
Reactions are currently unavailable
We deployed 6.1.0 on SH in Splunk Cloud. I replicated config from my sandbox instance, which works fine. In Splunk Cloud it terminates with exception: