Unable to upgrade splunk spp for content pack (DA-ITSI-ContentLibrary) - Modular input initialization failure

Available Languages

Updated:October 1, 2026
Document ID:SPLK054012

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk IT Service Intelligence (ITSI) Splunk App for Content Packs Versions Affected: Content Pack 2.3.0 upgrading to 2.4.0 or 2.5.0 Environment: Standalone and Search Head Cluster (SHC) deployments (Both on-prem and cloud)

Description

The upgrade of the Splunk App for Content Packs fails because subdirectories contained in the new package conflict with existing content pack directories from a previous installation, causing the content_pack_install_message modular input to fail during initialization. 
 


Investigation

Confirm the error in splunkd.log:

index=_internal source=*splunkd.log* "content_pack_install_message" ERROR
When splunkd.log shows Introspecting scheme=<script_name>: script running failed, reproduce the error by running the same script with --scheme to get the full traceback. This is a standard Splunk technique for debugging modular input initialization failures.
sudo /opt/splunk/bin/splunk cmd python \ ./etc/apps/DA-ITSI-ContentLibrary/bin/content_pack_install_message.py --scheme


Resolution

In SHC environment two separate bundle pushes are required - one to remove, one to install:

Step1: Remove the existing directory on the deployer
 
Step2: Push the bundle to propagate the removal to all members     
Step3: Restart the SHC members after the bundle push completes.
Step4: Unpack the new content pack version on the deployer:         
Step5: Push the bundle again to deploy the fresh version

./splunk apply shcluster-bundle -target https://<captainIP>:8089 -auth username:password Step6: Restart the SHC members after the bundle push completes.

Verify the error is resolved via UI and backend:

 
sudo /opt/splunk/bin/splunk cmd python \ ./etc/apps/DA-ITSI-ContentLibrary/bin/content_pack_install_message.py --scheme

Revision History

Revision Publish Date Comments
1.0
01-Oct-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco