Archive

Got this error "Unable to initialize modular input" from indexer after deploy a Splunk_TA_paloalto to indexer

daniel_splunk
Splunk Employee
Splunk Employee

The error message that I got is this one. But I found that it is a general error and would like to know the root cause.

Search peer idx16.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.

Search peer idx2.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.

Search peer idx6.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.
Tags (1)

daniel_splunk
Splunk Employee
Splunk Employee

According to this link,

http://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall
(Indexer cluster section)

We need to remove the following file if the TA is deployed to indexer cluster.

  1. Remove the eventgen.conf files and all files in the samples folder.
  2. Remove the inputs.conf file, if it contains one.
  3. Remove the database.conf file, if it contains one.

In your case, you can run the following command to fix the issue.

mv /opt/splunk/etc/master-apps/Splunk_TA_paloalto/default/inputs.conf /opt/splunk/etc/master-apps/Splunk_TA_paloalto/default/inputs.conf.orig

mv /opt/splunk/etc/master-apps/Splunk_TA_paloalto/README/inputs.conf.spec /opt/splunk/etc/master-apps/Splunk_TA_paloalto/README/inputs.conf.spec.orig

darlas
Communicator

Hi Daniel.

I have this same problem and want to be clear on your solution.

I deploy this add-on from a deployment server. It gets pushed to my search heads and indexers.

Are you saying to remove the listed files on the deployment server then push out or remove on just the indexers? If just the indexers, how do you do this while still having those files pushed to your search heads?

Thanks a bunch!

0 Karma

daniel_splunk
Splunk Employee
Splunk Employee

Does your indexer in a cluster environment? That procedure only apply to indexer cluster. That means you need to change Splunk_TA_paloalto in cluster master and then deploy to indexer member.

darlas
Communicator

Hi Daniel.

Thanks for the quick response. We have multiple indexers but do not believe they are in a cluster. There is no "master" indexer. we do have a Deployment Server that manages all indexers, search heads, etc... But I don't think that is what you mean.

Thanks.

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!