Monitoring Splunk

Unable to find solution for error in splunkd log file

shreyasathavale
Communicator

Hey I am getting this error in splunkd log file, I am unable to understand what is the error. The error is

SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='delimExtractionsIIS2003-WEB'

Tags (1)
1 Solution

lguinn2
Legend

I suspect that you have an invalid attribute specified in one of your transforms.conf files. See if this will find it for you:

Go to the Splunk bin directory ($SPLUNK_HOME/bin)

./splunk btool check

OR, for Windows

splunk btool check

btool checks the configuration files and notifies you of any suspicious or invalid settings. You can also use the Splunk-on-Splunk app (SOS) to perform this and many other diagnostic checks.

btool

View solution in original post

lguinn2
Legend

I suspect that you have an invalid attribute specified in one of your transforms.conf files. See if this will find it for you:

Go to the Splunk bin directory ($SPLUNK_HOME/bin)

./splunk btool check

OR, for Windows

splunk btool check

btool checks the configuration files and notifies you of any suspicious or invalid settings. You can also use the Splunk-on-Splunk app (SOS) to perform this and many other diagnostic checks.

btool

shreyasathavale
Communicator

Thanks lguinn , I found that DELIMS was set to nothing
It was : DELIMS=
I will be correcting it to : DELIMS= " "

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...