Splunk Security Essential(SSE): CIM Compliance Check page failing with Error messageError in 'sseidenrichment' command: (AttributeError) module 'time' has no attribute 'clock'

Available Languages

Updated:September 29, 2026
Document ID:SPLK047809

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Security Essentials version 3.8.0 Splunk Enterprise Splunk Cloud

Description

In the Splunk Security Essentials App > Security Operations tab > The "CIM Compiance Check" page, it includes a dashboard that provides insights of those fields per-product, and tells users  how those products are doing.

 

CIM compliance is performed by checking common field values against a regular expression. However, when attempting to open this page, many of the searches within the dashboard fail with the following error message.

Error in 'sseidenrichment' command: (AttributeError) module 'time' has no attribute 'clock

Screenshot below for reference:

It is important to note that this issue persists despite having the latest versions of the Current downloaded security content, Current ShowcaseInfo, and Current Mitre ATT&CK installed.


Investigation

During the initial investigation, error messages were found in the Console menu of the Inspect tab in Google Chrome.

 

ie. In Google Chrome > Mouse Right Click [fn + F12 for mac]> Inspect > Console

 
Also found "404 error" message in the Network tab of Inspect tab as shown below:

 
 
It was observed that the error, "Error in 'sseidenrichment' command: (AttributeError) module 'time' has no attribute 'clock'", suggests that the issue is caused by an outdated Python library in the environment where Splunk is running.
 
Specifically, the error indicates that the time.clock() function is being called within the sseidenrichment command in the SPL implementation, but this function was removed in Python 3.8.
 

If Splunk is running on a version that uses Python 3.8 or later, and since the SSE app relies on time.clock(), this incompatibility arises. To confirm this, the issue was tested in an environment with a Python version lower than 3.8, where it did not occur.


Resolution

This was a known issue in Splunk Security Essential version 3.8.0 which has been fixed in version 3.8.1.


GitHub Docs

Python Compatibility - Splunk Enterprise

Python Compatibility - Splunk Cloud

Revision History

Revision Publish Date Comments
1.0
29-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products