Add a token for HTTP requeste and run btool:
splunk btool check --debug
You'll get this error:
Checking: /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf
Invalid key in stanza [http://splunk_machine_du_output] in /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf, line 8: description (value: xyz).
Did you mean 'disabled'?
description is not a valid field for inputs.conf
Have a look at this: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf for available keys.
Try removing it and running btool again
description
is valid for a token stanza of HTTP Event Collector. It looks like the issue is that inputs.conf.spec is missing the entry. I'll get this fixed.
Your stanza looks correct and should work fine. For example here is a stanza on my box that properly displays the description in the UI.
Sorry for the confusion.
Just checked and we already fixed this in the next version and it is also fixed now in Splunk Cloud.
Here is the entry in inputs.conf.spec
description =
* Human-readable description of this token.
* Defaults to empty string.
Right. The problem is the web UI sticks the description in there.
I have replicated your issue. You are correct the UI does add the description to the inputs.conf, and then btool throws an invalid key warning.
Definitely something for Splunk to take a look at in a future release, but it shouldn't have any impact on your server other than the warning message
I can recreate this if I create an input as well and use characters such as á (or ä, ß). I'm guessing you have such characters in your description because "splunk_machine_du_output" sounds french to me.
This isn't exactly a problem though, splunk should work fine regardless.
You don't reckon she means the command du ?
Ah. Yeah, that makes sense... not my strongest moment apparently.
Yes du refers to the *nix du command.
As jeffland says make sure ther are no special characters in the description field
It's xyz. Nothing special.
false errors, is never NOT a problem 🙂
Right - let me rephrase that: this is an annoyance and you could call it a bug, but it should not interfere with splunk operating properly.
What does the stanza [http://splunk_machine_du_output] look like?
[http://splunk_machine_du_output]
disabled = 0 index = disk_space_index
indexes = disk_space_index source =
splunk_box sourcetype = our_sourcetype
token =
20202020-4242-4343-4343-434334343434
description = xyz