The error message that I got is this one. But I found that it is a general error and would like to know the root cause.
Search peer idx16.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.
Search peer idx2.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.
Search peer idx6.my-indexcluster.com has the following message: Unable to initialize modular input "autofocus_export" defined inside the app "Splunk_TA_paloalto": Unable to locate suitable script for introspection.
According to this link,
http://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall
(Indexer cluster section)
We need to remove the following file if the TA is deployed to indexer cluster.
In your case, you can run the following command to fix the issue.
mv /opt/splunk/etc/master-apps/Splunk_TA_paloalto/default/inputs.conf /opt/splunk/etc/master-apps/Splunk_TA_paloalto/default/inputs.conf.orig
mv /opt/splunk/etc/master-apps/Splunk_TA_paloalto/README/inputs.conf.spec /opt/splunk/etc/master-apps/Splunk_TA_paloalto/README/inputs.conf.spec.orig
Hi Daniel.
I have this same problem and want to be clear on your solution.
I deploy this add-on from a deployment server. It gets pushed to my search heads and indexers.
Are you saying to remove the listed files on the deployment server then push out or remove on just the indexers? If just the indexers, how do you do this while still having those files pushed to your search heads?
Thanks a bunch!
Does your indexer in a cluster environment? That procedure only apply to indexer cluster. That means you need to change Splunk_TA_paloalto in cluster master and then deploy to indexer member.
Hi Daniel.
Thanks for the quick response. We have multiple indexers but do not believe they are in a cluster. There is no "master" indexer. we do have a Deployment Server that manages all indexers, search heads, etc... But I don't think that is what you mean.
Thanks.