Developing for Splunk Enterprise

Unable to initialize modular input "jms" defined inside the app "jms_ta": Unable to locate suitable script for introspection for Index clustering

shahk
Explorer

Hello Team.

I have index clustering setup which comprises of 1 index master and 2 index peers. NOw I want to add jm_ta add on modular for index clustering.
I extracted the jms modular zip file in $splunk_home/etc/master-apps and validated the bundle and restarted the splunk. It is not showing the "jms messaging" input in Datainput. And shows below error

Unable to initialize modular input "jms" defined inside the app "jms_ta": Unable to locate suitable script for introspection.

Can somebody suggest how do install jms-messaging-modular input in index clustering so that it can be pushed to index peers and it is visible in data input?

Tags (1)
0 Karma

Damien_Dallimor
Ultra Champion

In a distributed environment I would install the JMS Mod Input on a Forwarder instance.

0 Karma

arcdevil
Path Finder

In this case, it may be worth to install a separate Splunk server and use it only for modular inputs that do not support or are not designed for clustering, so as not to lose the opportunity to configure them via a web interface?

0 Karma

shahk
Explorer

Hi Arc,

Here is what I have done. I distributed the add on jms_messaging_input modular from master index to peer indexing and whr it was pushed in $splunk_home/etc/slave-apps directory and i could show in the apps section in web UI/ But since i could not see the add on in Data inputs , i copied the whole bundle to $splunk_home/etc/apps directory and restarted the splunkd . And I was able to see the add on.

I am not sure it is the right way , now it has to be tested the correct way.

Frankly speaking there is no proper documentation for adding modular input for indexing cluster.

0 Karma

arcdevil
Path Finder

Have you tried manually install app on index nodes? And use files from master-apps for configuration only.

0 Karma

arcdevil
Path Finder

How indexing works

You can set up your cluster so that all the peer nodes ingest external data. This is the most common scenario. You do this simply by configuring inputs on each peer node. However, you can also set up the cluster so that only a subset of the peer nodes ingest data. No matter how you disperse your inputs across the cluster, all the peer nodes can, and likely will, also store replicated data. The master determines, on a bucket-by-bucket basis, which peer nodes will get replicated data. You cannot configure this, except in the case of multisite clustering, where you can specify the number of copies of data that each site's set of peers receives.

0 Karma

shahk
Explorer

Also this is not an app. it is add on which pull the message queues from active mq servers.

0 Karma

shahk
Explorer

Hi Arc,

If I manually install app in index nodes in $splunk_home/etc/apps directory , i am sure it will show the add on in setting-->DataInputs.

An the error message I mentioned is showing in Master Index splunk web UI.

My question is , If manually install apps in index peers , will the data pulled by this add on will be clustered?

Also is there any different procedure has to be followed for insalling add on in index clustering?

0 Karma
Get Updates on the Splunk Community!

Maximize the Value from Microsoft Defender with Splunk

<P style=" text-align: center; "><span class="lia-inline-image-display-wrapper lia-image-align-center" ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

<FONT size="5"><FONT size="5" color="#FF00FF">Get the latest news and updates from the Splunk Community ...