Getting Data In

Creating an HTTP Event Collector input generates "invalid key in stanza" error when running btool on the description field

NaraSplunk
Explorer

Add a token for HTTP requeste and run btool:
splunk btool check --debug

You'll get this error:

Checking: /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf
        Invalid key in stanza [http://splunk_machine_du_output] in /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf, line 8: description  (value:  xyz).
    Did you mean 'disabled'?

jplumsdaine22
Influencer

description is not a valid field for inputs.conf

Have a look at this: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf for available keys.

Try removing it and running btool again

0 Karma

gblock_splunk
Splunk Employee
Splunk Employee

description is valid for a token stanza of HTTP Event Collector. It looks like the issue is that inputs.conf.spec is missing the entry. I'll get this fixed.

Your stanza looks correct and should work fine. For example here is a stanza on my box that properly displays the description in the UI.

Sorry for the confusion.

0 Karma

gblock_splunk
Splunk Employee
Splunk Employee

Just checked and we already fixed this in the next version and it is also fixed now in Splunk Cloud.

Here is the entry in inputs.conf.spec

description =
* Human-readable description of this token.
* Defaults to empty string.

0 Karma

dougmartin
Path Finder

Right. The problem is the web UI sticks the description in there.

0 Karma

jplumsdaine22
Influencer

I have replicated your issue. You are correct the UI does add the description to the inputs.conf, and then btool throws an invalid key warning.

Definitely something for Splunk to take a look at in a future release, but it shouldn't have any impact on your server other than the warning message

0 Karma

jeffland
SplunkTrust
SplunkTrust

I can recreate this if I create an input as well and use characters such as á (or ä, ß). I'm guessing you have such characters in your description because "splunk_machine_du_output" sounds french to me.

This isn't exactly a problem though, splunk should work fine regardless.

jplumsdaine22
Influencer

You don't reckon she means the command du ?

0 Karma

jeffland
SplunkTrust
SplunkTrust

Ah. Yeah, that makes sense... not my strongest moment apparently.

0 Karma

dougmartin
Path Finder

Yes du refers to the *nix du command.

0 Karma

jplumsdaine22
Influencer

As jeffland says make sure ther are no special characters in the description field

0 Karma

dougmartin
Path Finder

It's xyz. Nothing special.

0 Karma

dougmartin
Path Finder

false errors, is never NOT a problem 🙂

0 Karma

jeffland
SplunkTrust
SplunkTrust

Right - let me rephrase that: this is an annoyance and you could call it a bug, but it should not interfere with splunk operating properly.

0 Karma

jplumsdaine22
Influencer

What does the stanza [http://splunk_machine_du_output] look like?

0 Karma

dougmartin
Path Finder

[http://splunk_machine_du_output]
disabled = 0 index = disk_space_index
indexes = disk_space_index source =
splunk_box sourcetype = our_sourcetype
token =
20202020-4242-4343-4343-434334343434
description = xyz

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...