Getting Data In

typo on inputs.conf for splunktcp-ssl compressed option

mataharry
Communicator

Since I upgraded to 6.0, I see this warning
Possible typo in stanza [splunktcp-ssl:9997] in /splunk/etc/system/local/inputs.conf, line 5: compressed = true
Did you mean 'concurrentChannelLimit'?
Did you mean 'connection_host'?

Tags (2)
1 Solution

ekost
Splunk Employee
Splunk Employee

After upgrading to Splunk 5.0.4 or later, the "Possible typo in stanza ... compressed = true" on stdout will be displayed if Splunk was configured to use a combination of SSL compression and the non-SSL compression.
Until you plan to change the non-SSL compression setting on all of the forwarders, do not remove this setting from the inputs.conf after upgrading; changing it will block all forwarder communications that attempt to use non-SSL compression.

The typo warning is about a deprecated setting for SSL communications only. The warning does not stop the port from accepting inbound communications from a forwarder using both compression options. The forwarders will continue to function normally.
The compression setting is required to be synchronized between the outputs.conf on the forwarders and the inputs.conf on the indexers. Splunk does not dynamically adapt to compression settings.

Prior to Splunk 4.3, the setting for Splunk-to-Splunk communications using the setting 'compressed = true' was applicable to both SSL and non-SSL forwarder communications.
The behavior for the setting changed after version 4.3.1 so that *compressed = tru*e applies to non-SSL forwarder communications only.
SSL compression is managed by the setting useClientSSLCompression in server.conf and is enabled by default.

View solution in original post

ekost
Splunk Employee
Splunk Employee

After upgrading to Splunk 5.0.4 or later, the "Possible typo in stanza ... compressed = true" on stdout will be displayed if Splunk was configured to use a combination of SSL compression and the non-SSL compression.
Until you plan to change the non-SSL compression setting on all of the forwarders, do not remove this setting from the inputs.conf after upgrading; changing it will block all forwarder communications that attempt to use non-SSL compression.

The typo warning is about a deprecated setting for SSL communications only. The warning does not stop the port from accepting inbound communications from a forwarder using both compression options. The forwarders will continue to function normally.
The compression setting is required to be synchronized between the outputs.conf on the forwarders and the inputs.conf on the indexers. Splunk does not dynamically adapt to compression settings.

Prior to Splunk 4.3, the setting for Splunk-to-Splunk communications using the setting 'compressed = true' was applicable to both SSL and non-SSL forwarder communications.
The behavior for the setting changed after version 4.3.1 so that *compressed = tru*e applies to non-SSL forwarder communications only.
SSL compression is managed by the setting useClientSSLCompression in server.conf and is enabled by default.

yannK
Splunk Employee
Splunk Employee

In latest splunk 5.* and 6., the option **compressed* has been removed from the inputs for splunktcp-ssl stanza.

[EDIT]
this is causing typo warnings. Beware, the indexer does not honor the forwarder configuration. If you have compression setup on the old forwarders, you need to have the same at the indexer level.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...