Issue with misprest.py

[hunty-dumpy]

Hi, misprest command is returning the error: Error in 'script': Getinfo probe failed for external search command 'misprest'.

I believe it may be due to the commands.conf being set to True on the support_getinfo part: [misprest] python. Version = python3 filename = misprest.py local = true run_in_preview = false enableheader = true outputheader = true requires_srinfo = true supports_getinfo = true

Which I think true is meant only if it's expected to run on versions of Splunk 6.3 and earlier. we are on Splunk Cloud Version: 8.2.2202.1 and misp42 version 4.2 (latest)

Reference: https://docs.splunk.com/DocumentationStatic/PythonSDK/1.7.2/searchcommands.html?highlight=getinfo

I'm not 100% sure if that's the root cause though.

Thanks in advance Thomas

[remg427]

Hi, Thanks for using misp42. I could check not earlier than next week Best Remi

Le 14 février 2023 16:58:27 GMT+01:00, Thomas de Brelaz @.***> a écrit :

Hi, misprest command is returning the error: Error in 'script': Getinfo probe failed for external search command 'misprest'.

I believe it may be due to the commands.conf being set to True on the support_getinfo part: [misprest] python. Version = python3 filename = misprest.py local = true run_in_preview = false enableheader = true outputheader = true requires_srinfo = true supports_getinfo = true

Which I think true is meant only if it's expected to run on versions of Splunk 6.3 and earlier. we are on Splunk Cloud Version: 8.2.2202.1 and misp42 version 4.2 (latest)

Reference: https://docs.splunk.com/DocumentationStatic/PythonSDK/1.7.2/searchcommands.html?highlight=getinfo

I'm not 100% sure if that's the root cause though.

Thanks in advance Thomas

-- Reply to this email directly or view it on GitHub: https://github.com/remg427/misp42splunk/issues/223 You are receiving this because you are subscribed to this thread.

Message ID: @.***> -- Sent with K-9 Mail.

[remg427]

Hi, I have reviewed the settings and ended up with supports_rawargs = true requires_srinfo = true supports_getinfo = true

next version is going to use new instruction chunked = true