Health Check warning for intel_exporter.py exiting abnormally with exit status 1

Applicability

Description

A Health Check banner notification appears in the Splunk Cloud / Enterprise Security web interface:

Health Check: msg="A script exited abnormally with exit status: 1" input="./opt/splunk/etc/apps/DA-ESS-TIM/bin/intel_exporter.py" stanza="intel_exporter://main"

The warning recurs periodically (typically every 5 minutes, aligned with the threat intelligence sync schedule).

Threat intelligence data ingestion into the 'threat_intelligence' index may experience delays or incomplete updates.

Investigation

1. Check if the threat intelligence dashboard is populating data by navigating to Analytics -> Threat Intelligence.
2. Check if TIM (DA-ESS-TIM) is enabled under Apps -> Threat Intelligence.
3. The intel_exporter.py script should be enabled to successfully connect to TIM services. Make sure it is enabled under Data Inputs -> TIM - Intel Exporter.
4. If all of the above are working, the TIM data should be populated in the 'threat_intelligence' index. Check if latest events being written to this index.
   

   index=threat_intelligence

5. confirm if your environment is encountering this specific issue, run the following search to check the internal logs:

   index=_internal sourcetype=splunkd intel_exporter log_level=ERROR | table _time, host, message

6. Check if the intel_exporter.py is logging an error related to data formatting or string handling during the threat intelligence extraction process such as below:
   

   09-16-2026 04:57:31.665 +0000 ERROR ExecProcessor [2049377 ExecProcessor] - message from "/opt/splunk/bin/python3.13 /opt/splunk/etc/apps/DA-ESS-TIM/bin/intel_exporter.py" 'list' object has no attribute 'strip' - Traceback (most recent call last): File "/opt/splunk/etc/apps/DA-ESS-TIM/lib/splunklib/modularinput/script.py", line 67, in run_script self.stream_events(self._input_definition, event_writer) ~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/opt/splunk/etc/apps/DA-ESS-TIM/bin/tim/intel_exporter/exporter_service.py", line 50, in _run_source indicator_events = source.extract(raw_record) File "/opt/splunk/etc/apps/DA-ESS-TIM/bin/tim/intel_exporter/sources.py", line 85, in extract return self._extractor.extract(raw_record) ~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^ File "/opt/splunk/etc/apps/DA-ESS-TIM/bin/tim/intel_exporter/extractors/tif_intel.py", line 83, in extract observable_value = observable_value.strip() ^^^^^^^^^^^^^^^^^^^^^^ AttributeError: 'list' object has no attribute 'strip'

Resolution

Cause:
The intel_exporter.py process is responsible for exporting and synchronizing threat intelligence indicators into the threat_intelligence index so they can be searched and displayed in ES dashboards.

In Enterprise Security version 8.6, when the exporter processes threat intelligence feeds containing complex or multi-value indicator formats, an unhandled data format exception occurs. This causes the export process to stop unexpectedly before finishing the batch, triggering the health check alert.

Resolution:

This is a known issue. Upgrade ES to 8.7 for a permanent fix.

As an interim fix, one can suppress the health check warnings by disabling the intel_exporter.py script by accessing the `script_error_msg_ignore` macro available under Settings > Advanced Search > Search macros > Edit and add the below to the definition.

OR (script LIKE "%intel_exporter.py" AND exit_status=1)