All Apps and Add-ons

Palo Alto Networks Add-on "Unable to initialize modular input"

Explorer

After the installation of the Palo Alto Networks Add-on for Splunk I'm getting a message saying:

Unable to initialize modular input "minemeld_feed" defined in the app "Splunk_TA_paloalto": Introspecting scheme=minemeld_feed: script running failed (exited with code 1)

The Add-on is not doing anything in the web interface. I've tried reinstalling it and also installing an older version, but the error stays the same.

0 Karma
1 Solution

Explorer

I figured it out, the Add-on does not work with Python 3. Setting Python 2 in the server.conf solved the problem.

View solution in original post

Explorer

I figured it out, the Add-on does not work with Python 3. Setting Python 2 in the server.conf solved the problem.

View solution in original post

Explorer

Here is some additional information from the logs that reappears everytime splunk is restarted:

  • 03-19-2020 17:11:28.998 +0100 INFO SpecFiles - Found external scheme definition for stanza="minemeld_feed://" from spec file="C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\README\inputs.conf.spec" with parameters="feed_url, indicator_timeout, credentials"
  • 03-19-2020 17:11:28.404 +0100 ERROR ModularInputs - Unable to initialize modular input "minemeld_feed" defined in the app "Splunk_TA_paloalto": Introspecting scheme=minemeld_feed: script running failed (exited with code 1)..
  • 03-19-2020 17:11:28.404 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: script running failed (exited with code 1).
  • 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: ModuleNotFoundError: No module named 'urllib2'
  • 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: import urllib2
  • 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: File "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\solnlib\splunk_rest_client.py", line 24, in
  • 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: from . import splunk_rest_client as rest_client
  • 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: File "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\solnlib\acl.py", line 21, in
  • 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: from . import (
  • 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: File "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\solnlib_init_.py", line 19, in
  • 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: from solnlib.packages.splunklib import modularinput as smi
  • 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: File "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\splunk_ta_paloalto\modinput_wrapper\base_modinput.py", line 10, in
  • 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: import modinput_wrapper.base_modinput
  • 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: File "C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\bin\minemeld_feed.py", line 9, in
  • 03-19-2020 17:11:28.389 +0100 ERROR ModularInputs - Introspecting scheme=minemeld_feed: Traceback (most recent call last):
  • 03-19-2020 17:11:26.826 +0100 INFO SpecFiles - Found external scheme definition for stanza="minemeld_feed://" from spec file="C:\Program Files\Splunk\etc\apps\Splunk_TA_paloalto\README\inputs.conf.spec" with parameters="feed_url, indicator_timeout, credentials"
0 Karma