All Apps and Add-ons

Splunk App for VMware: Invalid key in stanza - Acceleration

fairje
Communicator

Getting the following error when starting the Splunk service on my DCN:

Checking conf files for problems...
                Invalid key in stanza [dm_accel_settings://Performance] in /opt/splunk/etc/apps/Splunk_TA_vmware/default/inputs.conf, line 77: acceleration  (value:  true)
                Invalid key in stanza [dm_accel_settings://Change_Analysis] in /opt/splunk/etc/apps/Splunk_TA_vmware/default/inputs.conf, line 80: acceleration  (value:  true)
                Invalid key in stanza [dm_accel_settings://Authentication] in /opt/splunk/etc/apps/Splunk_TA_vmware/default/inputs.conf, line 83: acceleration  (value:  true)
                Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
        Done

Here are the relevant lines in the inputs.conf:

[dm_accel_settings://Performance]
acceleration = true

[dm_accel_settings://Change_Analysis]
acceleration = true

[dm_accel_settings://Authentication]
acceleration = true

It appears that there is no information in the .spec file for this field which is why it errors. Here is my inputs.conf.spec file:

# Copyright (C) 2005-2014 Splunk Inc. All Rights Reserved.
[ta_vmware_collection_worker://<name>]
capabilities = <value>
* this is the comma delimited list of actions that the worker can perform (hostvmperf, otherperf, etc.)
log_level = <value>
* the level at which the worker will log data.
duration = <value>
* the minimum time between runs of the input should it exit for some reason

[ta_vmware_collection_scheduler://<name>]
* the scheduler should only exist once
log_level = <value>
* the level at which the scheduler will log data.
duration = <value>
* the minimum time between runs of the input should it exit for some reason

Since this is in the default inputs.conf file, I can only assume that someone hasn't updated the respective .spec file to also accommodate this property?

1 Solution

Masa
Splunk Employee
Splunk Employee

The spec file is in SA-Utils. Please double-check if SA-Utils is installed in the same Splunk instance.

View solution in original post

Masa
Splunk Employee
Splunk Employee

The spec file is in SA-Utils. Please double-check if SA-Utils is installed in the same Splunk instance.

bryan_dady
Explorer

As of v3.2, neither SA-Hydra nor SA-Utils are required on the Indexer, yet we still get the 'Invalid key in stanza' errors during splunk start (as well as from `splunk btool check --debug).

Splunk App for VMware -latest- component reference

bnolan
Engager

I'm right there with you Bryan... To get past this I searched through all the SA's and TA's looking at the inputs.conf.spec files. I found that the stanza Splunk_TA_vmware was expecting lives in the SA-VMNetAppUtils inputs.conf.spec file (SA-VMNetAppUtils/README/inputs.conf.spec). I copied the necessary stanza from there, made a backup copy of the inputs.conf.spec file in Splunk_TA_vmware, and then pasted the missing stanza into the inputs spec file. From there I ran my cluster bundle apply and saw no errors.

For reference, here is the missing stanza:
`[dm_accel_settings://default]
* Configure an input for enforcing data model acceleration settings automatically
* when another app is installed. Note that only one app at a time should define
* the acceleration settings for a given data model. Usually this is the "primary"
* app for the suite of apps on the system, e.g. SplunkEnterpriseSecuritySuite.

acceleration = [true|false]
* True if the data model should be accelerated.

manual_rebuilds = [true|false]
* If true, changes to the datamodel will not automatically rebuild the HPAS
* data store.`

0 Karma

fairje
Communicator

Thanks, somehow I overlooked that and the SA-Hydra being installed on the DCN.

For reference here is the appropriate link to the docs that breaks out what needs to be installed and where:

http://docs.splunk.com/Documentation/VMW/3.1.4/Configuration/Componentreference

fairje
Communicator

It is kinda weird to me that they put those in the Splunk_TA_vmware App instead of sticking those specific inputs lines inside an inputs file inside of SA-Utils. Because if you mess it up there isn't an intuitive way to identify where you made the mistake.

0 Karma

Masa
Splunk Employee
Splunk Employee

same idea as multiple props.conf all over apps and addons. You can add only one spec file to make use of the Modular Input scope in other add-ons instead of copying the spec file all over. btool is your friend for configurations.

One thing I agree with is that, there is no easy tool provided by Splunk in order to find a spec file.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...