After recently configuring the Splunk Add-on for Check Point OPSEC LEA, I'm finding these errors reported in my splunk_ta_checkpoint-opseclea_modinput.log and no events are indexed.
2016-12-27 20:25:58,983 +0000 log_level=ERROR, pid=10558, tid=Thread-5, file=ta_data_collector.py, func_name=index_data, code_line_no=108 | [input_name="SPLUNKLEA" data="non_audit"] Failed to index data, reason:
Traceback (most recent call last):
File "/opt/PROD/6.4.3.a/splunk/etc/apps/Splunk_TA_checkpoint-opseclea/bin/splunk_ta_checkpoint_opseclea/splunktaucclib/data_collection/ta_data_collector.py", line 105, in index_data
self._do_safe_index()
File "/opt/PROD/6.4.3.a/splunk/etc/apps/Splunk_TA_checkpoint-opseclea/bin/splunk_ta_checkpoint_opseclea/splunktaucclib/data_collection/ta_data_collector.py", line 148, in _do_safe_index
self._client = self._create_data_client()
File "/opt/PROD/6.4.3.a/splunk/etc/apps/Splunk_TA_checkpoint-opseclea/bin/splunk_ta_checkpoint_opseclea/splunktaucclib/data_collection/ta_data_collector.py", line 73, in _create_data_client
ckpt = self._get_ckpt()
File "/opt/PROD/6.4.3.a/splunk/etc/apps/Splunk_TA_checkpoint-opseclea/bin/splunk_ta_checkpoint_opseclea/splunktaucclib/data_collection/ta_data_collector.py", line 64, in _get_ckpt
return self._checkpoint_manager.get_ckpt()
File "/opt/PROD/6.4.3.a/splunk/etc/apps/Splunk_TA_checkpoint-opseclea/bin/splunk_ta_checkpoint_opseclea/splunktaucclib/data_collection/ta_checkpoint_manager.py", line 32, in get_ckpt
return self._store.get_state(key)
File "/opt/PROD/6.4.3.a/splunk/etc/apps/Splunk_TA_checkpoint-opseclea/bin/splunk_ta_checkpoint_opseclea/splunktalib/state_store.py", line 202, in get_state
state = json.load(jsonfile)
File "/opt/PROD/6.4.3.a/splunk/lib/python2.7/json/__init__.py", line 291, in load
**kw)
File "/opt/PROD/6.4.3.a/splunk/lib/python2.7/json/__init__.py", line 339, in loads
return _default_decoder.decode(s)
File "/opt/PROD/6.4.3.a/splunk/lib/python2.7/json/decoder.py", line 364, in decode
obj, end = self.raw_decode(s, idx=_w(s, 0).end())
File "/opt/PROD/6.4.3.a/splunk/lib/python2.7/json/decoder.py", line 382, in raw_decode
raise ValueError("No JSON object could be decoded")
ValueError: No JSON object could be decoded
... View more
