Does splunkd service sends a signal to the data input to start the script even if the modular input is disabled?

[rishabhshah]

I'm aware about the fact to remove the inputs.conf before installing the TAs collecting the logs on the SHC but if the inputs are still present in the disabled state I'm getting errors like "Unable to initialize modular input".

Hence, want to understand if the scripts continues running in the backend even if the inputs are in disabled state and throws error or is it something else I'm not aware about?

[marnall]

I am curious about this, could you say which TA is trying to initialize the modular input even if the inputs.conf stanzas are disabled?

[rishabhshah]

It's the MSCS and google TA. On SHC, inputs.conf are removed from default and local still the error appears as below on all the members.

ERROR ModularInputs [1990877 ConfReplicationThread] - Unable to initialize modular input "mscs_storage_table" defined in the app "splunk_ta_microsoft-cloudservices": Introspecting scheme=mscs_storage_table: script running failed

[PickleRick]

Did you check the btool output? Inputs shouldn't normally be run when disabled. That's the whole point of defined disabled inputs - define them in a "ready to run" state by default but let them be enabled or disabled selectively.

[rishabhshah]

Yes, I have already checked the btool output. Nothing shows up when I run the command as the inputs.conf are removed.

[PickleRick]

That's even more interesting because if there is no input defined (not even disabled ones), nothing should be started. Maybe your settings were not applied.

Check output of "splunk show config inputs" to see what are the contents of in-memory Splunk's "running-config".

[rishabhshah]

There is no significance of MSCS inputs when I output the content from "splunk show config inputs" still the error is present. This is very strange.

[PickleRick]

Ahhhh... one more thing. I think the error can persist from before you disabled/deleted the inputs. AFAIR I had similar issues with VMware vCenter inputs. Until the events rolled off the _internal index, the error persisted within the WebUI.

[rishabhshah]

I'm afraid to say I removed the inputs last week but still I can see errors in last 15 minutes ☹️

[PickleRick]

Wait, you're seing those errors in events in _internal? Not just in the webui? That's unexpected.

[rishabhshah]

I see those error in both web ui and _internal

[PickleRick]

That is very strange. I'd try restarting splunkd and if the problem persists I'd raise a support case because a non-existent input should definitely _not_ run,