Getting Data In

Configure 10Gbps network capture - Invalid key in stanza [streamfwd] in /opt/splunk/etc/apps/Splunk_TA_stream/local/streamfwd.conf,

joerosen2020
New Member

Hey Splunkers,

Why am I getting the following error message when running dedicated capture mode for Splunk stream? Followed the instructions outlined here.

I'm currently testing dedicated capture mode on Ubuntu instead of RHEL/CentOS. I don't think thats the problem though.

Invalid key in stanza [streamfwd] in /opt/splunk/etc/apps/Splunk_TA_stream/local/streamfwd.conf, line 4: dedicatedCaptureMode (value: 1).
Did you mean 'duplicatePacketWindow'?

Here are my current config files for directory /opt/splunk/etc/apps/Splunk_TA_stream/local#

inputs.conf
[streamfwd://streamfwd]
splunk_stream_app_location = http://localhost:8000/en-us/custom/splunk_app_stream/
stream_forwarder_id =
disabled = 0

streamfwd.conf
[streamfwd]
dedicatedCaptureMode = 1
streamfwdcapture.0.interface = 0000:86:00.1

streamfwd.xml.bak

<InterfaceRegex>enp134s0f1</InterfaceRegex>
<Offline>false</Offline>

Here is the output from the debug using btool:
sudo ./splunk btool check --debug
Checking: /opt/splunk/etc/users/admin/search/local/ui-prefs.conf
Checking: /opt/splunk/etc/users/admin/search/local/ui-tour.conf
Checking: /opt/splunk/etc/users/admin/splunk_app_stream/local/ui-prefs.conf
Checking: /opt/splunk/etc/users/admin/user-prefs/local/user-prefs.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_bro/local/inputs.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_stream/local/inputs.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_stream/local/streamfwd.conf
Invalid key in stanza [streamfwd] in /opt/splunk/etc/apps/Splunk_TA_stream/local/streamfwd.conf, line 2: dedicatedCaptureMode (value: 1).
Did you mean 'duplicatePacketWindow'?
Checking: /opt/splunk/etc/apps/learned/local/props.conf
Checking: /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf
Checking: /opt/splunk/etc/apps/splunk_instrumentation/local/telemetry.conf
Checking: /opt/splunk/etc/apps/SplunkForwarder/default/app.conf
Checking: /opt/splunk/etc/apps/SplunkForwarder/default/default-mode.conf
Checking: /opt/splunk/etc/apps/SplunkForwarder/default/outputs.conf
Checking: /opt/splunk/etc/apps/SplunkForwarder/default/server.conf
Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/app.conf
Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/default-mode.conf
Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/indexes.conf
Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/inputs.conf
Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/limits.conf
Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/outputs.conf
Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/props.conf
Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/server.conf
Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/web.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/app.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/commands.conf
No spec file for: /opt/splunk/etc/apps/Splunk_TA_bro/default/eventgen.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/eventtypes.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/indexes.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/inputs.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/props.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/tags.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/transforms.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/app.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/distsearch.conf
No spec file for: /opt/splunk/etc/apps/Splunk_TA_stream/default/eventgen.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/eventtypes.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/inputs.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/outputs.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/props.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/server.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/streamfwd.conf
No spec file for: /opt/splunk/etc/apps/Splunk_TA_stream/default/streamfwdlog.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/tags.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/transforms.conf
Checking: /opt/splunk/etc/apps/alert_logevent/default/alert_actions.conf
Checking: /opt/splunk/etc/apps/alert_logevent/default/app.conf
Checking: /opt/splunk/etc/apps/alert_logevent/default/restmap.conf
Checking: /opt/splunk/etc/apps/alert_webhook/default/alert_actions.conf
Checking: /opt/splunk/etc/apps/alert_webhook/default/app.conf
Checking: /opt/splunk/etc/apps/alert_webhook/default/restmap.conf
Checking: /opt/splunk/etc/apps/appsbrowser/default/app.conf
Checking: /opt/splunk/etc/apps/gettingstarted/default/app.conf
Checking: /opt/splunk/etc/apps/introspection_generator_addon/default/app.conf
Checking: /opt/splunk/etc/apps/introspection_generator_addon/default/inputs.conf
Checking: /opt/splunk/etc/apps/introspection_generator_addon/default/server.conf
Checking: /opt/splunk/etc/apps/launcher/default/app.conf
Checking: /opt/splunk/etc/apps/launcher/default/launcher.conf
Checking: /opt/splunk/etc/apps/legacy/default/app.conf
Checking: /opt/splunk/etc/apps/legacy/default/props.conf
Checking: /opt/splunk/etc/apps/sample_app/default/app.conf
Checking: /opt/splunk/etc/apps/sample_app/default/indexes.conf
Checking: /opt/splunk/etc/apps/sample_app/default/inputs.conf
Checking: /opt/splunk/etc/apps/sample_app/default/props.conf
Checking: /opt/splunk/etc/apps/search/default/app.conf
Checking: /opt/splunk/etc/apps/search/default/commands.conf
Checking: /opt/splunk/etc/apps/search/default/event_renderers.conf
Checking: /opt/splunk/etc/apps/search/default/macros.conf
Checking: /opt/splunk/etc/apps/search/default/props.conf
Checking: /opt/splunk/etc/apps/search/default/restmap.conf
Checking: /opt/splunk/etc/apps/search/default/savedsearches.conf
Checking: /opt/splunk/etc/apps/search/default/transforms.conf
Checking: /opt/splunk/etc/apps/splunk_app_stream/default/app.conf
No spec file for: /opt/splunk/etc/apps/splunk_app_stream/default/cloud.conf
Checking: /opt/splunk/etc/apps/splunk_app_stream/default/collections.conf
Checking: /opt/splunk/etc/apps/splunk_app_stream/default/distsearch.conf
Checking: /opt/splunk/etc/apps/splunk_app_stream/default/eventtypes.conf
Checking: /opt/splunk/etc/apps/splunk_app_stream/default/inputs.conf
Checking: /opt/splunk/etc/apps/splunk_app_stream/default/macros.conf
Checking: /opt/splunk/etc/apps/splunk_app_stream/default/restmap.conf
Checking: /opt/splunk/etc/apps/splunk_app_stream/default/savedsearches.conf
Checking: /opt/splunk/etc/apps/splunk_app_stream/default/times.conf
Checking: /opt/splunk/etc/apps/splunk_app_stream/default/ui-tour.conf
Checking: /opt/splunk/etc/apps/splunk_app_stream/default/web.conf
Checking: /opt/splunk/etc/apps/splunk_app_stream/default/workflow_actions.conf
Checking: /opt/splunk/etc/apps/splunk_archiver/default/app.conf
Checking: /opt/splunk/etc/apps/splunk_archiver/default/commands.conf
Checking: /opt/splunk/etc/apps/splunk_archiver/default/distsearch.conf
Checking: /opt/splunk/etc/apps/splunk_archiver/default/props.conf
Checking: /opt/splunk/etc/apps/splunk_archiver/default/savedsearches.conf
Checking: /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf
Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/alert_actions.conf
Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/app.conf
Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/collections.conf
Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/commands.conf
Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/inputs.conf
Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/macros.conf
Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/props.conf
Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/restmap.conf
Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/savedsearches.conf
Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/telemetry.conf
Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/web.conf
Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/app.conf
Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/checklist.conf
Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/distsearch.conf
Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/dmc_alerts.conf
Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/inputs.conf
Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/macros.conf
Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/props.conf
Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/savedsearches.conf
Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/splunk_monitoring_console_assets.conf
Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/transforms.conf
Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/visualizations.conf
Checking: /opt/splunk/etc/apps/user-prefs/default/app.conf
Checking: /opt/splunk/etc/apps/user-prefs/default/user-prefs.conf
Checking: /opt/splunk/etc/master-apps/_cluster/default/indexes.conf
Checking: /opt/splunk/etc/system/default/alert_actions.conf
Checking: /opt/splunk/etc/system/default/app.conf
Checking: /opt/splunk/etc/system/default/audit.conf
Checking: /opt/splunk/etc/system/default/authentication.conf
Checking: /opt/splunk/etc/system/default/authorize.conf
Checking: /opt/splunk/etc/system/default/collections.conf
Checking: /opt/splunk/etc/system/default/commands.conf
No spec file for: /opt/splunk/etc/system/default/conf.conf
Checking: /opt/splunk/etc/system/default/datamodels.conf
Checking: /opt/splunk/etc/system/default/datatypesbnf.conf
Checking: /opt/splunk/etc/system/default/default-mode.conf
Checking: /opt/splunk/etc/system/default/distsearch.conf
Checking: /opt/splunk/etc/system/default/event_renderers.conf
Checking: /opt/splunk/etc/system/default/eventdiscoverer.conf
Checking: /opt/splunk/etc/system/default/eventtypes.conf
Checking: /opt/splunk/etc/system/default/fields.conf
Checking: /opt/splunk/etc/system/default/health.conf
Checking: /opt/splunk/etc/system/default/indexes.conf
Checking: /opt/splunk/etc/system/default/inputs.conf
Checking: /opt/splunk/etc/system/default/limits.conf
Checking: /opt/splunk/etc/system/default/livetail.conf
Checking: /opt/splunk/etc/system/default/messages.conf
Checking: /opt/splunk/etc/system/default/multikv.conf
Checking: /opt/splunk/etc/system/default/outputs.conf
Checking: /opt/splunk/etc/system/default/procmon-filters.conf
Checking: /opt/splunk/etc/system/default/props.conf
Checking: /opt/splunk/etc/system/default/restmap.conf
Checking: /opt/splunk/etc/system/default/savedsearches.conf
Checking: /opt/splunk/etc/system/default/segmenters.conf
Checking: /opt/splunk/etc/system/default/server.conf
Checking: /opt/splunk/etc/system/default/serverclass.conf
Checking: /opt/splunk/etc/system/default/source-classifier.conf
Checking: /opt/splunk/etc/system/default/telemetry.conf
Checking: /opt/splunk/etc/system/default/times.conf
Checking: /opt/splunk/etc/system/default/transactiontypes.conf
Checking: /opt/splunk/etc/system/default/transforms.conf
Checking: /opt/splunk/etc/system/default/ui-prefs.conf
Checking: /opt/splunk/etc/system/default/ui-tour.conf
Checking: /opt/splunk/etc/system/default/viewstates.conf
Checking: /opt/splunk/etc/system/default/visualizations.conf
Checking: /opt/splunk/etc/system/default/web.conf
Checking: /opt/splunk/etc/system/default/workflow_actions.conf
Checking: /opt/splunk/etc/system/local/inputs.conf
No spec file for: /opt/splunk/etc/system/local/migration.conf
Checking: /opt/splunk/etc/system/local/server.conf

Tags (1)
0 Karma

VatsalJagani
SplunkTrust
SplunkTrust

@chrisjk , @joerosen2020  - That option (dedicatedCaptureMode) is not available in streamfwd.conf.spec file.

But I do see that option in the latest Add-on documentation (https://docs.splunk.com/Documentation/StreamApp/8.0.1/DeployStreamApp/ForwarderParameters). So it seems like it's an issue from the Add-on side.

VatsalJagani_0-1651248329878.png

 

 

I hope this helps!! Upvote/karma would be appreciated!!

0 Karma

chrisjk
Observer

Was this ever answered somewhere? I'm having the same issue now using Stream 8.0.2 and Splunk 8.2.5

Tags (1)
0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...