Why am I getting "Invalid key in stanza" errors trying to configure the Splunk Add-on for Microsoft Cloud Services?

[a212830]

Hi,

I'm following the doc for configuring Splunk Add-on for Microsoft Cloud Services (http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureaccount ), and using config files, but keep getting an "invalid stanza key in stanza" error.

 Checking conf files for problems...
                Invalid key in stanza [TESTSVB] in /apps/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/local/splunk_ta_ms_o365_server_settings.conf, line 2: client_id (value: "123456").
                Invalid key in stanza [TESTSVB] in /apps/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/local/splunk_ta_ms_o365_server_settings.conf, line 3: client_secret (value: "123456").
                Invalid key in stanza [TESTSVB] in /apps/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/local/splunk_ta_ms_o365_server_settings.conf, line 4: tenant_id (value: "123456").

I don't see any issues with these values. Anyone run into this?

[TESTSVB]
client_id="123456"
client_secret="123456"
tenant_id="123456"

[logging]
agent = DEBUG
server = DEBUG
disabled = 0

[proxy]
proxy_enabled = 1
proxy_port = 8000
proxy_rdns = 1
proxy_type = http
proxy_url = https.proxy.fmr.com
disabled = 0

[Masa · Accepted solution]

Probably you are supposed to edit * splunk_ta_ms_o365_server_accounts.conf*, not splunk_ta_ms_o365_server_settings.conf

[sloshburch]

@a212830 and I talked on the side and I think this is the same conclusion we had. @a212830 - tis true? Accept this answer?

[Masa]

@SloshBurch, Thank you for the follow-up.

More information about the warning message,
splunk btool check --debug compares configurations with its spec file.

For a custom app's custom conf files, developer needs to provide spec file in etc/apps/$app_name$/README directory. If spec file is missing proper attributes or stanza or configurations(attributes or stanzas) do not match with attributes or stanza in the spec file, warning message will be generated like this case.

[sloshburch]

@masa - thanks for elaborating for posterity!

@a212830 - I noticed you haven't accepted the answer and usually you do that so just wanted to check: all set with this question or something outstanding?

[a212830]

This particular problem is fixed, but still not seeing data. Investigating.