Applicability
Splunk Enterprise
Splunk Cloud
Description
The modular inputs configured in the Splunk Infrastructure Monitoring Add-on
v1.2.3 seem to become unresponsive after a certain period and in the internal logs, there do not appear to be any error or warning messages. When these inputs are re-enabled, the logs start flowing again.
Investigation
Run the below SPL Query to check if there are any error messages in the
_internal logs,
SPL:
index=_internal sourcetype="splunk_ta_sim"
The internal logs exclusively consist of
INFO entries; no
ERROR or
WARNING logs are present.
The last log entry for the input indicates that the status is "
running" after which input was not able to invocate again.
After a more in-depth review, it was found that the issue was due to
SignalFx Library and for the same, a new version was going introduced ie.
v1.2.4 to resolve the issue.
In the newer version, the SIM-Addon team will add a heartbeat check on their own end which will monitor the flow of data. If data is not being received after a particular time interval existing input will terminate the existing connection and let the modular input run again forming a new connection and resuming the data flow.
Heart beat check mechanism which will monitor the data streams and terminate the connection if the streams are stuck and start it again.
Resolution
Need to upgrade the
SIM Add-on to
v1.2.4 which involves the implementation of a heartbeat check mechanism to resolve the Intermittent Modular input hang issues.
SIM Add-on v1.2.4 Fixed Issues
Revision History
| Revision |
Publish Date |
Comments |
1.0 |
29-Sep-2026
|
Initial Release |