Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Inalid key in stanza (multiple issues) #130

Open
trafford-tbe opened this issue Sep 9, 2024 · 0 comments
Open

Inalid key in stanza (multiple issues) #130

trafford-tbe opened this issue Sep 9, 2024 · 0 comments

Comments

@trafford-tbe
Copy link

Here is list of my finding for version 0.3.3:

  • default.meta

Invalid key in stanza [] in default.meta, line 5: owner = admin.

Why owner is not allowed for all objects? It works just fine on 9.1.x

  • outputs.conf

Stanza [tcpout-server://idx01.splunk.lab:9997] does not seem to be a valid stanza.

Invalid key in stanza [tcpout-server://idx01.splunk.lab:9997] in outputs.conf, line 30: sslAltNameToCheck = idx01.splunk.lab.
Perfectly working configuration for SSL configuration with SAN verification.

  • inputs.conf

Invalid key in stanza [monitor://C:\inetpub\logs\LogFiles\W3SVC*\*.log] in inputs.conf, line 6: ignoreOlderThan = 7d.

Why? Since documented under:
https://docs.splunk.com/Documentation/Splunk/9.1.5/Admin/Inputsconf#MONITOR:

Invalid key in stanza [http://name] in inputs.conf, line 7: queueSize = 256KB.

Why? Since documented under:
https://docs.splunk.com/Documentation/Splunk/9.1.5/Admin/Inputsconf#HTTP_Event_Collector_.28HEC.29_-_Local_stanza_for_each_token

Invalid key in stanza [splunktcp-ssl:9997] in inputs.conf, line 6: inputShutdownTimeout = 60.

Option used for encrypted version.

Invalid key in stanza [house_keeping://default] in inputs.conf, line 34: interval = 300.

Custom config for modular input.

  • app.conf

Invalid key in stanza [install] in app.conf, line 22: state_change_requires_restart = true .

Documented in: https://docs.splunk.com/Documentation/Splunk/9.1.5/Admin/Appconf#.5Binstall.5D

  • restmap.conf

Invalid key in stanza [script:alertqueue] in restmap.conf, line 14: match = /alertqueue.
Invalid key in stanza [script:alertqueue] in restmap.conf, line 20: requireAuthentication = true.

Per endpoint attributes:
https://docs.splunk.com/Documentation/Splunk/9.1.5/Admin/Restmapconf#GLOBAL_SETTINGS

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant