All Apps and Add-ons

Splunk Add-on for F5 BIG-IP: Why am I unable to initialize the modular input?


Search peer has the following message: Unable to initialize modular input "Splunk_TA_f5_bigip_main" defined inside the app "Splunk_TA_f5-bigip": Unable to locate suitable script for introspection.

0 Karma

Path Finder

I have resovled this problem just only adding a comment for the stanza and attributes inside the config file inputs.conf.spec as showing below:

FILE => .../Splunk_TA_f5-bigip/README/inputs.conf.spec
# [Splunk_TA_f5_bigip_main://]

# nothing=nothing

Then restart splunk.

0 Karma


I work with Stan here and I was able to fix this by doing the following:

  • I removed the README/inputs.conf.spec filefor the app (since we were deploying on index clusters, there were no need for the inputs.conf on these servers).
  • I also commented out the stanza for the input in the default/log_info.conf .

After I pushed these changes to the IDX cluster, we stopped receiving the error message.

New Member

do u use Universal Forwarder to receive data from F5 ? based on syslog ?

then how you send them to indexers ?
is the TA working on indexers?

0 Karma


That error might because of wrong installation or configuration.

Check below link for hardware and software requirements.

Hope this helps .

0 Karma


getting the above error when f5-bigip is loaded on to our index cluster peers.

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!