After installing the Sideview_utils and Splunk on Splunk apps getting the following:
Possible typo in stanza [default] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 2: request.ui_context =
Possible typo in stanza [default] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 3: request.ui_edit_view =
Possible typo in stanza [test_saved_search_with_serialized_context_positive] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 11: request.ui_context = group1=per_index_thruput&group2=per_host_thruput&group3=per_sourcetype_thruput&group3=per_source_thruput&group4=per_index_thruput&group5=per_host_thruput&group6=per_sourcetype_thruput&group6=per_source_thruput&group7=per_index_thruput&group8=per_host_thruput&group9=per_sourcetype_thruput&group9=per_source_thruput
Possible typo in stanza [test_saved_search_with_serialized_context_negative] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 21: request.ui_context = group1=per_source_thruput&group2=per_source_thruput&group3=per_source_thruput&group3=per_host_thruput&group4=per_host_thruput&group5=per_source_thruput&group6=per_source_thruput&group6=per_index_thruput&group7=per_source_thruput&group8=per_sourcetype_thruput&group9=per_index_thruput&group9=per_host_thruput
Possible typo in stanza [test_saved_search_for_back_button_cases] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 29: request.ui_context = textfield1=baz3&autoRun=True&pulldown1=foo3&pulldown2=bar3&checkbox=true
There might be typos in your conf files.
Any help would be greatly appreciated.
The "possible typos" related to Sideview utils can be safely ignored. Splunk has a "schema" file for each config file telling it what it should expect as far as stanza/key names, and some of Sideview Util's configuration objects are not in that schema.
This error message will go away in the next version of SoS.
The "possible typos" related to Sideview utils can be safely ignored. Splunk has a "schema" file for each config file telling it what it should expect as far as stanza/key names, and some of Sideview Util's configuration objects are not in that schema.
Splunk provided a mechanism to extend the schema, and Utils follows that mechanism, but some older versions of Splunk still gave the warning regardless. I think on 4.3 and 5.0 these warnings don't happen anymore because Splunk sees the declarations in the readme dir and thus recognizes the stanzas as intentional config rather than typos.
Thanks for the info
Also seeing the following when I open the SOS App:
Misconfigured view 'inputs' - Unknown parameter 'level' is defined for module Message. Make sure the parameter is specified in Message.conf.