Splunk Security Essential(SSE): Data Inventory Overview page failing with Error message: "Error in 'sseidenrichment' command: (AttributeError) module 'time' has no attribute 'clock'"

Available Languages

Updated:September 29, 2026
Document ID:SPLK047345

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Security Essentials Splunk Enterprise Splunk Cloud

Description

The "Data Inventory Overview" page in the Splunk Security Essentials App includes a dashboard that provides insights into products related to their data. However, when attempting to open this page, many of the searches within the dashboard fail with the following error message.

  • Error in 'sseidenrichment' command: (AttributeError) module 'time' has no attribute 'clock'

Screenshot below for reference,

 

Screenshot 2024-09-15 at 7.34.34 PM.png

It is important to note that this issue persists despite having the latest versions of the Current downloaded security content, Current ShowcaseInfo, and Current Mitre ATT&CK installed.


Investigation

During the initial investigation, several error messages were found in the Console menu of the Inspect tab in Google Chrome

ie. In Google Chrome > Mouse Right Click > Inspect > Console

 
Errors:
 
POST https://sh1.daya-noah.stg.splunkcloud.com/en-GB/splunkd/__raw/services/search/v2/jobs/admin__admin_U3BsdW5rX1NlY3VyaXR5X0Vzc2VudGlhbHM__RMD59364055b1df3cf51_1726408915.6860/results_preview 400 (Bad Request)
 
Error Screenshot:
 
 
Also found "400 Bad Request" message in the Network tab of Inspect tab.
ie. In Google Chrome > Mouse Right Click > Inspect > Network
 
Screenshot:
 
 
 
After further debugging the Error found in the GUI ie. "Error in 'sseidenrichment' command: (AttributeError) module 'time' has no attribute 'clock'", suggests that the issue is caused by an outdated Python library in the environment where Splunk is running.
 
Specifically, the error indicates that the time.clock() function is being called within the sseidenrichment command in the SPL implementation, but this function was removed in Python 3.8.

If Splunk is running on a version that uses Python 3.8 or later, and since the SSE app relies on time.clock(), this incompatibility arises. To confirm this, the issue was tested in an environment with a Python version lower than 3.8, where it did not occur.

 

After discussing this behaviour with the engineering team, they confirmed the issue. They are working on a resolution, which will be included in version 3.8.1 of the Splunk Security Essentials App. The estimated release date for version 3.8.1 is the end of September 2024 or the beginning of October 2024, if everything goes as planned.


Resolution

The permanent fix for this issue will be included in version 3.8.1 of the Splunk Security Essentials (SSE) App. As a temporary workaround, python version can be downgraded to 3.7.x or lower in the Splunk environment where the SSE App is installed and in use.


GitHub Docs

Python Compatibility - Splunk Enterprise

Python Compatibility - Splunk Cloud

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products