Search peer has the following message: Unable to initialize modular input "Splunk_TA_f5_bigip_main" defined inside the app "Splunk_TA_f5-bigip": Unable to locate suitable script for introspection.
I have resovled this problem just only adding a comment for the stanza and attributes inside the config file inputs.conf.spec as showing below:
FILE => .../Splunk_TA_f5-bigip/README/inputs.conf.spec
Then restart splunk.
I work with Stan here and I was able to fix this by doing the following:
After I pushed these changes to the IDX cluster, we stopped receiving the error message.
do u use Universal Forwarder to receive data from F5 ? based on syslog ?
then how you send them to indexers ?
is the TA working on indexers?
That error might because of wrong installation or configuration.
Check below link for hardware and software requirements.
Hope this helps .
getting the above error when f5-bigip is loaded on to our index cluster peers.