Got this error "Unable to initialize modular input" from indexer after deploy a Splunk_TA_paloalto to indexer

[daniel_splunk]

The error message that I got is this one. But I found that it is a general error and would like to know the root cause.

Search peer idx16.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.

Search peer idx2.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.

Search peer idx6.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.

[daniel_splunk]

According to this link,

http://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall
(Indexer cluster section)

We need to remove the following file if the TA is deployed to indexer cluster.

1. Remove the eventgen.conf files and all files in the samples folder.
2. Remove the inputs.conf file, if it contains one.
3. Remove the database.conf file, if it contains one.

In your case, you can run the following command to fix the issue.

mv /opt/splunk/etc/master-apps/Splunk_TA_paloalto/default/inputs.conf /opt/splunk/etc/master-apps/Splunk_TA_paloalto/default/inputs.conf.orig

mv /opt/splunk/etc/master-apps/Splunk_TA_paloalto/README/inputs.conf.spec /opt/splunk/etc/master-apps/Splunk_TA_paloalto/README/inputs.conf.spec.orig

[darlas]

Hi Daniel.

I have this same problem and want to be clear on your solution.

I deploy this add-on from a deployment server. It gets pushed to my search heads and indexers.

Are you saying to remove the listed files on the deployment server then push out or remove on just the indexers? If just the indexers, how do you do this while still having those files pushed to your search heads?

Thanks a bunch!

[daniel_splunk]

Does your indexer in a cluster environment? That procedure only apply to indexer cluster. That means you need to change Splunk_TA_paloalto in cluster master and then deploy to indexer member.

[darlas]

Hi Daniel.

Thanks for the quick response. We have multiple indexers but do not believe they are in a cluster. There is no "master" indexer. we do have a Deployment Server that manages all indexers, search heads, etc... But I don't think that is what you mean.

Thanks.