Getting Data In

Splunk_TA_ontap throwing error message - Unable to initialize modular input



We are using Splunk_TA_ontap app. We are now seeing message " Unable to initialize modular input "ta_ontap_collection_worker" defined inside the app "Splunk_TA_ontap": Unable to locate suitable script for introspection. " From some reading I've done it looks like this could be a platform issue that the apps run on (Linux). The App claims it is platform independent.

We recently upgraded to 6.5.2 from 6.4.0 and began seeing this message.

Any ideas why?


Tags (1)


This is typically because the add-on is installed without SA-Hydra and SA-VMNetAppUtils.

This is a valid configuration if you install on you're indexer in a distributed environment. To fix it on the indexer (do not do this on DCN's SH's or anything other than indexers, assuming they're reporting the warning):
Delete the .spec files in the README directory, delete the inputs in default and delete all the sample files and restart Splunk on the indexer. If you are using clustering this should be done on the cluster master.

If this is a DCN, or your Search Head, then make sure you copy the SA-Hydra and SA-VMNetAppUtils's along with the TA.

0 Karma


No. I've basically not looked into this any further.

0 Karma


Also getting this error.

Were you ever able to resolve or anyone else have insight?

0 Karma


I had this issue on SH cluster, I just removed Splunk_TA_ontap/README/inputs.conf.spec and the message disappeared.

Hope this help...

Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...