topic Re: Got this error "Unable to initialize modular input" from indexer after deploy a Splunk_TA_paloalto to indexer in Splunk Search

Got this error "Unable to initialize modular input" from indexer after deploy a Splunk_TA_paloalto to indexer

daniel_splunk — Thu, 31 Aug 2017 04:16:04 GMT

The error message that I got is this one. But I found that it is a general error and would like to know the root cause.

Search peer idx16.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.

Search peer idx2.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.

Search peer idx6.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.

Re: Got this error "Unable to initialize modular input" from indexer after deploy a Splunk_TA_paloalto to indexer

daniel_splunk — Thu, 31 Aug 2017 04:19:48 GMT

According to this link,

http://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall
(Indexer cluster section)

We need to remove the following file if the TA is deployed to indexer cluster.

Remove the eventgen.conf files and all files in the samples folder.
Remove the inputs.conf file, if it contains one.
Remove the database.conf file, if it contains one.

In your case, you can run the following command to fix the issue.

mv /opt/splunk/etc/master-apps/Splunk_TA_paloalto/default/inputs.conf /opt/splunk/etc/master-apps/Splunk_TA_paloalto/default/inputs.conf.orig

mv /opt/splunk/etc/master-apps/Splunk_TA_paloalto/README/inputs.conf.spec /opt/splunk/etc/master-apps/Splunk_TA_paloalto/README/inputs.conf.spec.orig

Re: Got this error "Unable to initialize modular input" from indexer after deploy a Splunk_TA_paloalto to indexer

darlas — Wed, 22 Nov 2017 18:52:08 GMT

Hi Daniel.

I have this same problem and want to be clear on your solution.

I deploy this add-on from a deployment server. It gets pushed to my search heads and indexers.

Are you saying to remove the listed files on the deployment server then push out or remove on just the indexers? If just the indexers, how do you do this while still having those files pushed to your search heads?

Thanks a bunch!

Re: Got this error "Unable to initialize modular input" from indexer after deploy a Splunk_TA_paloalto to indexer

daniel_splunk — Tue, 29 Sep 2020 16:52:33 GMT

Does your indexer in a cluster environment? That procedure only apply to indexer cluster. That means you need to change Splunk_TA_paloalto in cluster master and then deploy to indexer member.

Re: Got this error "Unable to initialize modular input" from indexer after deploy a Splunk_TA_paloalto to indexer

darlas — Mon, 27 Nov 2017 16:50:16 GMT

Hi Daniel.

Thanks for the quick response. We have multiple indexers but do not believe they are in a cluster. There is no "master" indexer. we do have a Deployment Server that manages all indexers, search heads, etc... But I don't think that is what you mean.

Thanks.