topic Re: Error message in Enterprise Security in Installation

Error message in Enterprise Security

gcusello — Sat, 28 Oct 2023 10:11:59 GMT

Hi at all,

I installed Enterprise Security 7.2.0 on Splunk 9.1.1 and I'm receiving the following message:

Unable to initialize modular input "confcheck_es_bias_language_cleanup" defined in the app "SplunkEnterpriseSecuritySuite": Unable to locate suitable script for introspection..

I searched on the documentation and at https://docs.splunk.com/Documentation/ES/7.2.0/Install/Upgradetonewerversion#After_upgrading_to_version_7.2.0 I fond the following indication:

To prevent the display of the error messages, follow these workaround steps: Modify following file: On the search head cluster: /opt/splunk/etc/shcluster/apps/SplunkEnterpriseSecuritySuite/README/input.conf.spec On a standalone ES instance this file: /opt/splunk/etc/apps/SplunkEnterpriseSecuritySuite/README/input.conf.spec Add the following comment at the end of the file: ###### Conf File Check for Bias Language ###### #[confcheck_es_bias_language_cleanup://default] #debug = <boolean> (optional) If you are on standalone search head, follow these additional steps: Push changes to search head cluster by pushing the bundle apps. Clean the messages from the top of the page so that they do not display again. . In case of a standalone search head, restart the Splunk process.

passing that in the page they are speaking of an upgrade and i'm newly installing, that the file name is wrong (input.conf instead inputs.conf) and that they say to modify a .spec file, but how commented statements can solve an issue?

Obviously this solution didn't solved my issue.

Is there anyone that can hint a solution to my issue?

Thank you in avdance.

Ciao.

Giuseppe

Re: Error message in Enterprise Security

PickleRick — Sat, 28 Oct 2023 11:16:30 GMT

A modular input must have a specification so that Splunk knows how to let you configure it

https://dev.splunk.com/enterprise/docs/developapps/manageknowledge/custominputs/modinputsconfspec

So you need to have the confcheck_es_whsatever type of input defined.

Check your .spec files for stanza _not_ commented out.

If you don't have it - add it. Or remove inputs of this type altogether.

Re: Error message in Enterprise Security

gcusello — Sat, 28 Oct 2023 15:46:25 GMT

Hi @PickleRick,

thank you for your help!

I tried to set the debug to false and to disable it but without success,
do you think that i could comment all the input stanza?

Thank you again.

Ciao.

Giuseppe

Re: Error message in Enterprise Security

PickleRick — Sat, 28 Oct 2023 16:47:21 GMT

It's not about disabling it because then the input is still defined, just disabled. So you'd probably nees to edit the default/ files to remove the stanza altogether which of course is a bad idea. So I'd go for fixing the spec file.

Re: Error message in Enterprise Security

gcusello — Sun, 29 Oct 2023 09:32:05 GMT

Hi @PickleRick,

I'll try tomorrow morning to remove the full default stanza.

thank You.

Ciao.

Giuseppe

Re: Error message in Enterprise Security

gcusello — Tue, 31 Oct 2023 13:13:09 GMT

Hi at all,

Splunk Support solved my issue in a very strange way that I report for the other people of Community:

I removed the stanza from the default folder,
I added a stanza wioth disabled = 1 in local folder,
I removed the stanza from the $SPLUNK_HOME/SplunkEnterpriseSecuritySuite/README/inputs.conf.spec file.

I didn't understand why the last step, but at least solved my issue.

Ciao.

Giuseppe

Re: Error message in Enterprise Security

catanoium — Tue, 19 Dec 2023 15:48:04 GMT

Hi, we encountered the same issue after upgrading Splunk ES to 7.2.0.

I am kindly asking to be more detailed by what do you mean by :

I removed the stanza from the default folder, (which file in the default folder?)
I added a stanza with disabled = 1 in local folder, (again, in which file you added the stanza?)

Also, are you referring to this recommendation (Ref: hxxps://docs.splunk.com/Documentation/ES/7.2.0/RN/KnownIssues )?

Add the following comment at the end of the file.
Conf File Check for Bias Language
[confcheck_es_bias_language_cleanup://default]
debug = <boolean>

Re: Error message in Enterprise Security

gcusello — Wed, 20 Dec 2023 07:25:26 GMT

Hi @catanoium ,

As you can read in the last action, the file is inputs.conf.

Ciao.

Giuseppe