|
Since I upgraded to 4.2, I am getting errors reported on stdout when Splunk is started from the command line :
|
|
Splunk 4.2 checks the keys (only keys, not values!) in live configuration files by comparing them with the contents of the spec file for that configuration file. For example, let's say that I create the following stanza in $SPLUNK_HOME/etc/system/local/inputs.conf :
On splunkd startup, there will be a syntax check for the "crcPepper" configuration key performed against the keys listed for the [monitor://] stanza type in $SPLUNK_HOME/etc/system/README/inputs.conf.spec - http://www.splunk.com/base/Documentation/latest/Admin/Inputsconf :
(...)
As you can imagine, the "crcPepper" key will not be found here which will cause Splunk to report the error on the standard output when splunkd is started from the command line :
Note that this only a warning, Splunk does not take any action other than reporting this possible syntax error. |
|
Previous versions of Splunk did not check configuration files for possible errors. Version 4.2 does,and issues warnings during startup. Some applications that work may contain invalid parameters names that don't affect functionality, but trigger the warnings. (Extraneous or misspelled parameters in most Splunk config is simply ignored.) You can either ignore the warnings, or check and remedy them. Some apps that were delivered in older versions of Splunk may have contain spurious but harmless entries that now generate the warnings. |

Could you please put the question into the question body, and set the title to be something that would indicate the contents of this question body? Thanks.
I think she's referring to these error messages during the upgrade: Possible typo in stanza [class_id] in /opt/splunk/etc/apps/SplunkforBlueCoat/default/transforms.conf, line 30: SOURC_KEY = ClassID
I saw this in my dev environment (haven't done my production environment yet).
Brian