Splunk Health Check Overview: How can we remove messages from this app?

[Arpit_S]

Getting "message from "python /opt/splunk/etc/slave-apps/Splunk_TA_aws/bin/splunk_ta_aws_sqs.py" 'placeholder': {'title': 'placeholder'}" in health overview app in Splunk.

The Splunk_TA_aws on our instance is already disabled.

What can we modify to get rid of these messages.

Thanks.

[hansuleberg]

Hi.

I get this warnings in SPLUNK ES of a part of TA that we do not use. Any idea to get this turned off/disabled?

Search peer [servername role indexer ] has the following message: Unable to initialize modular input "splunk_ta_aws_sqs" defined inside the app "Splunk_TA_aws": Unable to locate suitable script for introspection.

[Arpit_S]

I have enabled the TA in our instance and we are still able to see the Disable button next to the TA.

Also, doesn't it mean that disabling the app will disable all the configurations related to it?

[akira_splunk]

You likely have inputs within the app still enabled. Do not disable the app. Disable the inputs instead. If you want to limit access to the splunk_TA_aws app, limit the access to certain roles instead.

And FYI, after disabling the splunk_TA_aws on my system, I was prompted that a restart is required. I re-enabled the splunk_TA_aws app first, then restart my system. Since then the disable app link/button is gone. So perhaps it's not meant to be disabled.

And one last note, make sure your splunk_TA_aws inputs are setup on a heavy forwarder, NOT on your search head.

[Arpit_S]

Can anyone help??