Hello, I have this error on my ITSI with Distributed Search, how to fix this error?
ERROR [appserver] [itoa_exceptions] [init] [107801] [ITOA Validation Error]Publisher string not provided for the publish interface
I use splunk version 7.3.3 and the distribution are :
- 1 Splunk GUI
- 1 Splunk Index
- 1 Splunk Heavy Forwarder
ITSI version are 4.21
This is a benign error. SA-ITOA doesn't expect empty data to come from SAI and thus throws an unnecessary error instead of exiting gracefully.
This issue was fixed in 4.3.0. If you don't want to upgrade, a workaround is to disable the modular input 'Splunk App for Infrastructure - Entity Migration.'