Installation

I upgraded to Splunk 6.2.2 and now get errors with Splunk App for Nix and Windows.

bgamblin
Explorer

I now get these messages when the indexers start up:

  Checking filesystem compatibility...  Done
    Checking conf files for problems...
            Improper stanza [dhcpd_server_dhcprelease] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 30
            Value in stanza [app=/network/ntp:default] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 783 not URI encoded: app = /network/ntp:default
            Value in stanza [shell=/bin/bash] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 835 not URI encoded: shell = /bin/bash
            Value in stanza [shell=/bin/sh] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 838 not URI encoded: shell = /bin/sh
            Value in stanza [shell=/usr/bin/bash] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 841 not URI encoded: shell = /usr/bin/bash
            Value in stanza [shell=/usr/bin/pfksh] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 844 not URI encoded: shell = /usr/bin/pfksh
            Value in stanza [shell=/usr/bin/pfsh] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 847 not URI encoded: shell = /usr/bin/pfsh
            Value in stanza [Service_Name=kadmin/changepw] in /splunk/etc/apps/Splunk_TA_windows/default/tags.conf, line 135 not URI encoded: Service_Name = kadmin/changepw
            Value in stanza [app=win:local] in /splunk/etc/apps/Splunk_TA_windows/default/tags.conf, line 198 not URI encoded: app = win:local
            Value in stanza [app=win:remote] in /splunk/etc/apps/Splunk_TA_windows/default/tags.conf, line 201 not URI encoded: app = win:remote
            Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
    Done

All preliminary checks passed.

Has anyone seen this? What is the fix?

Tags (2)

ben_leung
Builder

so if you manage the ta under your deployment server and upgrade the app to the latest version while your deployment server is also on the latest version of splunk, what will happen to the older instances of splunk that do not complain about url encoded stanzas? can someone confirm backwards compatibility?

0 Karma

mikelanghorst
Motivator

It looks like 6.2 wants the tag to be url encoded, not "[shell=/bin/bash" but rather "[shell=%2Fbin%2Fbash]". But like phoffman said, update to latest version and it should be ok.

ski98033
Explorer

Try replacing the ':' in tags.conf with '_'

0 Karma

phoffman_splunk
Splunk Employee
Splunk Employee

What version are your NIX and Windows apps? You will want to verify you are on the latest version.

tim_connolly
Engager

I downvoted this post because this isn't an answer. it's simply a question for more information.

0 Karma

alekksi
Communicator

No, it's a suggestion to update to the latest version, which is also the resolution to this issue.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...