topic Re: Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled? in Splunk Enterprise

Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled?

rishabhshah — Thu, 21 Nov 2024 11:29:41 GMT

I'm aware about the fact to remove the inputs.conf before installing the TAs collecting the logs on the SHC but if the inputs are still present in the disabled state I'm getting errors like "Unable to initialize modular input".

Hence, want to understand if the scripts continues running in the backend even if the inputs are in disabled state and throws error or is it something else I'm not aware about?

Re: Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled?

marnall — Sun, 01 Dec 2024 04:43:37 GMT

I am curious about this, could you say which TA is trying to initialize the modular input even if the inputs.conf stanzas are disabled?

Re: Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled?

rishabhshah — Mon, 09 Dec 2024 08:51:48 GMT

It's the MSCS and google TA. On SHC, inputs.conf are removed from default and local still the error appears as below on all the members.

ERROR ModularInputs [1990877 ConfReplicationThread] - Unable to initialize modular input "mscs_storage_table" defined in the app "splunk_ta_microsoft-cloudservices": Introspecting scheme=mscs_storage_table: script running failed

Re: Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled?

PickleRick — Mon, 09 Dec 2024 09:48:26 GMT

Did you check the btool output? Inputs shouldn't normally be run when disabled. That's the whole point of defined disabled inputs - define them in a "ready to run" state by default but let them be enabled or disabled selectively.

Re: Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled?

rishabhshah — Mon, 09 Dec 2024 10:18:05 GMT

Yes, I have already checked the btool output. Nothing shows up when I run the command as the inputs.conf are removed.

Re: Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled?

PickleRick — Mon, 09 Dec 2024 10:41:50 GMT

That's even more interesting because if there is no input defined (not even disabled ones), nothing should be started. Maybe your settings were not applied.

Check output of "splunk show config inputs" to see what are the contents of in-memory Splunk's "running-config".

Re: Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled?

rishabhshah — Mon, 09 Dec 2024 11:20:10 GMT

There is no significance of MSCS inputs when I output the content from "splunk show config inputs" still the error is present. This is very strange.

Re: Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled?

PickleRick — Mon, 09 Dec 2024 11:29:07 GMT

Ahhhh... one more thing. I think the error can persist from before you disabled/deleted the inputs. AFAIR I had similar issues with VMware vCenter inputs. Until the events rolled off the _internal index, the error persisted within the WebUI.

Re: Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled?

rishabhshah — Mon, 09 Dec 2024 11:36:47 GMT

I'm afraid to say I removed the inputs last week but still I can see errors in last 15 minutes ☹️

Re: Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled?

PickleRick — Mon, 09 Dec 2024 11:39:37 GMT

Wait, you're seing those errors in events in _internal? Not just in the webui? That's unexpected.

Re: Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled?

rishabhshah — Mon, 09 Dec 2024 12:15:01 GMT

I see those error in both web ui and _internal

Re: Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled?

PickleRick — Mon, 09 Dec 2024 12:54:13 GMT

That is very strange. I'd try restarting splunkd and if the problem persists I'd raise a support case because a non-existent input should definitely _not_ run,

Re: Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled?

rishabhshah — Mon, 23 Dec 2024 09:10:36 GMT

@PickleRick Wanted to inform you that those errors are gone once I upgraded the TA to latest version.