Getting Data In

Splunk_TA_ontap throwing error message - Unable to initialize modular input

brdr
Contributor

Hi,

We are using Splunk_TA_ontap app. We are now seeing message " Unable to initialize modular input "ta_ontap_collection_worker" defined inside the app "Splunk_TA_ontap": Unable to locate suitable script for introspection. " From some reading I've done it looks like this could be a platform issue that the apps run on (Linux). The App claims it is platform independent.

We recently upgraded to 6.5.2 from 6.4.0 and began seeing this message.

Any ideas why?

Thx

Tags (1)

johnansett
Communicator

This is typically because the add-on is installed without SA-Hydra and SA-VMNetAppUtils.

This is a valid configuration if you install on you're indexer in a distributed environment. To fix it on the indexer (do not do this on DCN's SH's or anything other than indexers, assuming they're reporting the warning):
Delete the .spec files in the README directory, delete the inputs in default and delete all the sample files and restart Splunk on the indexer. If you are using clustering this should be done on the cluster master.

If this is a DCN, or your Search Head, then make sure you copy the SA-Hydra and SA-VMNetAppUtils's along with the TA.

0 Karma

brdr
Contributor

No. I've basically not looked into this any further.

0 Karma

Sp1unkin_it
Explorer

Also getting this error.

Were you ever able to resolve or anyone else have insight?

0 Karma

jgallo92
Engager

I had this issue on SH cluster, I just removed Splunk_TA_ontap/README/inputs.conf.spec and the message disappeared.

Hope this help...

Get Updates on the Splunk Community!

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...

Splunk APM: New Product Features + Community Office Hours Recap!

Howdy Splunk Community! Over the past few months, we’ve had a lot going on in the world of Splunk Application ...

Index This | Forward, I’m heavy; backward, I’m not. What am I?

April 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...