How to identify it:
1. When logging into Splunk DB Connect, users see the error:
Cannot communicate with task server, please check your settings.
<?xml version="1.0" encoding="UTF-8"?> <response> <messages> <msg type="WARN">Traceback (most recent call last): File "/opt/splunk/bin/rest_handler.py", line 79, in <module> print splunk.rest.dispatch(**params) File "/opt/splunk/lib/python2.7/site-packages/splunk/rest/__init__.py", line 149, in dispatch module = __import__('splunk.rest.external.%s' % parts[0], None, None, parts[0]) File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbxproxy.py", line 7, in <module> from dbx_settings import Settings File "/opt/splunk/etc/apps/splunk_app_db_connect/bin/dbx_settings.py", line 10, in <module> import splunklib.client as client File "/opt/splunk/etc/apps/TA-Proofpoint-TAP/bin/splunklib/__init__.py", line 18, in <module> from splunklib.six.moves import map ImportError: No module named six.moves </msg> </messages> </response>
2.Versions:
-Splunk 7.1.2
-Splunk DB Connect 3.1.3
-Proofpoint TA 1.0.8
How to fix it:
The problem is being caused by known issue: DBX-4623:
Add-ons are python based and the packaging common .py files and set Path/environmental variables point to their local copy. The issue is when the Python files are pointed from the last installed app. Now this might be ok if all the apps/add-ons on a box are using the same Python version but the problem happens when there is a version mismatch and the .py file is not the expected.”
The solution at this time is to downgrade Proofpoint TA to 1.0.1,
Be careful to downgrade the right Add-on, “Proofpoint TAP SIEM Modular Input” as there may be other Proofpoint add-on/app in use.
| Revision | Publish Date | Comments |
|---|---|---|
1.0 |
29-Sep-2026
|
Initial Release |