Hi @anandhalagaras1 , the file I've changed was under system>local>server.conf, so that the whole splunk instance is running with the old python version. But now I'm using the latest Palo Alto App + Add-on version 6.6.0, which works fine with python3. I wish you the best of luck with your problem! ... View more

Here is some additional information from the logs that reappears everytime splunk is restarted: 03-19-2020 17:11:28.998 +0100 INFO SpecFiles - Found external scheme definition for stanza="minemeld_feed://" from spec file="C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\README\inputs.conf.spec" with parameters="feed_url, indicator_timeout, credentials" 03-19-2020 17:11:28.404 +0100 ERROR ModularInputs - Unable to initialize modular input "minemeld_feed" defined in the app "Splunk_TA_paloalto": Introspecting scheme=minemeld_feed: script running failed (exited with code 1).. 03-19-2020 17:11:28.404 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: script running failed (exited with code 1). 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: ModuleNotFoundError: No module named 'urllib2' 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: import urllib2 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: File "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\solnlib\splunk_rest_client.py", line 24, in 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: from . import splunk_rest_client as rest_client 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: File "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\solnlib\acl.py", line 21, in 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: from . import ( 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: File "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\solnlib_init_.py", line 19, in 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: from solnlib.packages.splunklib import modularinput as smi 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: File "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\modinput_wrapper\base_modinput.py", line 10, in 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: import modinput_wrapper.base_modinput 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: File "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\minemeld_feed.py", line 9, in 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: Traceback (most recent call last): 03-19-2020 17:11:26.826 +0100 INFO SpecFiles - Found external scheme definition for stanza="minemeld_feed://" from spec file="C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\README\inputs.conf.spec" with parameters="feed_url, indicator_timeout, credentials" ... View more