Monitoring Splunk

ERROR TcpOutputProc - Illegal format for config item 'uri' What does it mean?

muebel
SplunkTrust
SplunkTrust

I'm finding the otherwise unimpactful messages :

ERROR TcpOutputProc - Illegal format for config item 'uri'

showing up in splunkd.log. I'm guessing this has something to do with a configuration stanza name problem, but it is a pretty vague message, and I'm hoping somebody could offer advice concerning the origin and purpose of this event. Thanks!

0 Karma

eagle4splunk
Explorer

Just ran into this issue and found that it was caused by a malformed list of servers in outputs.conf

puma_splunk
Engager

In my case (splunkforwarder-6.3.3-f44afce176d0-linux-2.6-x86_64.rpm), this error seems to have been caused by comments within inputs.conf:

[tcpout]
defaultGroup=Production
disabled=false

[tcpout:Production]
#server= 172.19.94.77:9997  # Model
server= 172.19.94.19:9997   # splunk-delphi.blah.com

Pruning all the comments and restarting splunkd seems to have fixed it. Bad parser?

0 Karma

bosburn_splunk
Splunk Employee
Splunk Employee

Muebel - can you check the pass4SymmKey in the forwarders outputs.conf and the pass4SymmKey in the [indexer_discovery] stanza in the server.conf of the cluster master?

ChrisG
Splunk Employee
Splunk Employee

Also: Support requests that you open a case on this one, so they can get a bug (or bugs) assigned to engineering, or attach the case to existing defect tickets.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...