After installing Splunk Add-on Builder, why do I receive error "Unable to initialize modular input "validation_mi""?

[Sukisen1981]

Unable to initialize modular input "validation_mi" defined inside the app "splunk_app_addon-builder": Introspecting scheme=validation_mi: script running failed (exited with code 1). 

Clicking on Splunk Add-on Builder opens a blank page > receive above message
Actions taken so far : deleted validation_mi

[Tyler]

For me, 4.0.0 was the version throwing the error and rolling back to 3.0.1 was the workaround. I've got an open case with Splunk, but it seems I may have finally solved it.

When searching _internal, I came across this:

"01-04-2022 10:13:36.430 -0600 ERROR ModularInputs [18196 MainThread] - <stderr> Introspecting scheme=validation_mi: ImportError: cannot import name 'etree' from 'lxml' (C:\Program Files\Splunk\etc\apps\splunk_app_addon-builder\bin\splunk_app_add_on_builder\lxml\__init__.py)"
"01-04-2022 10:13:36.430 -0600 ERROR ModularInputs [18196 MainThread] - <stderr> Introspecting scheme=validation_mi: from lxml import etree"
"01-04-2022 10:13:36.430 -0600 ERROR ModularInputs [18196 MainThread] - <stderr> Introspecting scheme=validation_mi: File ""C:\Program Files\Splunk\etc\apps\splunk_app_addon-builder\bin\tabuilder_utility\data_input_util.py"", line 10, in <module>"
"01-04-2022 10:13:36.430 -0600 ERROR ModularInputs [18196 MainThread] - <stderr> Introspecting scheme=validation_mi: Traceback (most recent call last):"

At first, I thought it was that the module was missing or it couldn't find it. But as you can see by

... ImportError: cannot import name 'etree' from 'lxml' (C:\Program Files\Splunk\etc\apps\splunk_app_addon-builder\bin\splunk_app_add_on_builder\lxml\__init__.py ...

that it does. I did a bit of poking around on PyPi and noticed their version wasn't the same as the app's. I believe the app used the source.

Long story short, Splunk Enterprise 8.2.3 uses Python 3.7 and AOB 4.0.0 uses lxml 4.6.3. Steps below will stop the error from appearing.

• Browse https://pypi.org/project/lxml/4.6.3/#files for the appropriate wheel (probably this one since most use Linux).
• Navigate to C:\Program Files\Splunk\etc\apps\splunk_app_addon-builder\bin\splunk_app_add_on_builder (or similar for Linux)
• Delete folders lxml and lxm-4.6.3-dist-info
• Copy the replacement folders (can open .whl with 7Zip)
• Restart Splunk.

[edgkassi]

Thanks, this worked for me! On Win I used this version.

[harig86]

hi all,

I'm getting error same error after installing the Splunk add-on builder(2.2.0) on Splunk 6.5. What could be the issue. I know if it is 3.0 then it won't work on Splunk < 8 version. I have python 2.3. Please help me with this.

[vishaltv]

Hey @harig86 
I suggest you to extract the package using 7zip and put it under $SPLUNK_HOME/etc/apps/
Then splunk restart.  It would work fine without any error. 
I suspect that it would kindoff read permission issue in package.  

[richgalloway]

@harig66 This question is more than 3 years old. For better chances at an answer, please post a new question.

[BainM]

Hi All-
Here is what I found in my experience:
The add-on builder 3.0.0 and 3.0.1 will NOT work for anything less than Splunk 8.0.0.

Please note! This is my experience and YMMV

Recommend:
Only use 2.2.0 with Splunk Enterprise <8.0.0 (example, I am successfully using TA-AddOnBuilder with Splunk ENT 7.2.7)

Hope this helps someone,
Mike

[timrich66]

This has resolved the issue for me. Thank you

[splk]

Is now also an issue for me after upgrading to Version 3.0.0.

[Sukisen1981]

Hi - Is there any answer from splunk gurus?