How to troubleshoot error "File contains no section headers" for the SA-SPLICE app?

[jlockie]

I am getting the following in our Splice logs

05-21-2015 11:10:57.421 -0700 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\SA-Splice\bin\taxii.py"" '\xef\xbb\xbf\n'
05-21-2015 11:10:56.919 -0700 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\SA-Splice\bin\taxii.py"" file: C:\Program Files\Splunk\etc\apps\SA-Splice\local\splice.conf, line: 1
05-21-2015 11:10:56.919 -0700 ERROR ExecProcessor - message from "python "C:\Program Files\Splunk\etc\apps\SA-Splice\bin\taxii.py"" ERRORFile contains no section headers.

I have MongoDB configured, and I can connect remotely using mongo.exe without credentials. I created the database "SPLICE" and I have the Splice app configured as such: mongodb://localhost:27017/SPLICE (mongodb is running on my Splunk server).
The IOC feed I am trying to connect to is the built-in "hailataxii" feed.

Does anyone have the first clue about these errors? Is this because I am running Splice in a Splunk Windows environment?

[cleroux_splunk · Accepted solution]

Splice has not been tested in Windows environment - it doesn't necessarily means that it doesn't works in such environments, just we don't know for sure!

According to the error I'm seeing here (File contains no section headers), make sure your splice.conf has the following format:

[splice]
mongo_connection_uri = mongodb://localhost:27017/splice

[jlockie]

Thanks. I ended up loading in Linux and Splice worked much better after that.