Archive

Got this error "Unable to initialize modular input" from indexer after deploy a Splunk_TA_paloalto to indexer

Splunk Employee
Splunk Employee

The error message that I got is this one. But I found that it is a general error and would like to know the root cause.

Search peer idx16.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.

Search peer idx2.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.

Search peer idx6.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.
Tags (1)

Splunk Employee
Splunk Employee

According to this link,

http://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall
(Indexer cluster section)

We need to remove the following file if the TA is deployed to indexer cluster.

  1. Remove the eventgen.conf files and all files in the samples folder.
  2. Remove the inputs.conf file, if it contains one.
  3. Remove the database.conf file, if it contains one.

In your case, you can run the following command to fix the issue.

mv /opt/splunk/etc/master-apps/Splunk_TA_paloalto/default/inputs.conf /opt/splunk/etc/master-apps/Splunk_TA_paloalto/default/inputs.conf.orig

mv /opt/splunk/etc/master-apps/Splunk_TA_paloalto/README/inputs.conf.spec /opt/splunk/etc/master-apps/Splunk_TA_paloalto/README/inputs.conf.spec.orig

Communicator

Hi Daniel.

I have this same problem and want to be clear on your solution.

I deploy this add-on from a deployment server. It gets pushed to my search heads and indexers.

Are you saying to remove the listed files on the deployment server then push out or remove on just the indexers? If just the indexers, how do you do this while still having those files pushed to your search heads?

Thanks a bunch!

0 Karma

Splunk Employee
Splunk Employee

Does your indexer in a cluster environment? That procedure only apply to indexer cluster. That means you need to change Splunk_TA_paloalto in cluster master and then deploy to indexer member.

Communicator

Hi Daniel.

Thanks for the quick response. We have multiple indexers but do not believe they are in a cluster. There is no "master" indexer. we do have a Deployment Server that manages all indexers, search heads, etc... But I don't think that is what you mean.

Thanks.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!