All Apps and Add-ons

PagerDuty App for Splunk 1.0: Why am I getting "Invalid key in stanza ... Did you mean 'param.incident_url'" for alert_actions.conf?

tjbaker72
Explorer

With the PagerDuty App for Splunk 1.0 installed on Splunk 6.4 I see this on Splunk start:

Checking conf files for problems...
    Invalid key in stanza [pagerduty] in /opt/splunk/etc/apps/pagerduty_incidents/local/alert_actions.conf, line 3: param.integration_url  (value:  ).
    Invalid key in stanza [pagerduty] in /opt/splunk/etc/apps/pagerduty_incidents/default/alert_actions.conf, line 9: param.incidents_url  (value: ).
    Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
Done

When running btool it prints:

Checking: /opt/splunk/etc/apps/pagerduty_incidents/local/alert_actions.conf
    Invalid key in stanza [pagerduty] in /opt/splunk/etc/apps/pagerduty_incidents/local/alert_actions.conf, line 3: param.integration_url  (value:  ).
Did you mean 'param.incident_url'?
Did you mean 'payload_format'?

Ideas?

jawaharas
Motivator

In '$SPLUNK_BASE/etc/apps/pagerduty_incidents/local/alert_actions.conf' file -

changing key name from 'param.integration_url' to 'param.incidents_url' (as mentioned in $SPLUNK_BASE/etc/apps/pagerduty_incidents/README/alert_actions.conf.spec) fixed issue.

# File name: $SPLUNK_BASE/etc/apps/pagerduty_incidents/local/alert_actions.conf
[pagerduty]
disabled = 0
param.incident_url = https://events.pagerduty.com/integration/<integration_code>/enqueue

I believe this is something the app developer has to fix in the upcoming release.

0 Karma

ThomasKoeberlei
Explorer

Hi,

did you create a alert_actions.conf.spec file in the README folder?

[pagerduty] 
param.integration_url=<string>
param.incidents_url=<string>

regards,
-thomas

tragiccode
New Member

I am having this same issue. What are you referring to thomas?

0 Karma

ThomasKoeberlei
Explorer

Take a look here: http://docs.splunk.com/Documentation/Splunk/6.5.3/AdvancedDev/CustomAlertConfig it describes that you need to have a alert_actions.conf file and an alert_actions.conf.spec file
Means take look on the file which is raising the error. Create in the apps README folder the *.spec file with the specification for the values.

0 Karma

tragiccode
New Member

I will create both of those files and give it a shot. It seems like the app would handle all of this setup by default. Am i missing something?

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

REGISTER NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If ...

Observability | Use Synthetic Monitoring for Website Metadata Verification

If you are on Splunk Observability Cloud, you may already have Synthetic Monitoringin your observability ...

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...