topic Re: Sideview_utils/Splunk on Splunk Error in All Apps and Add-ons

Sideview_utils/Splunk on Splunk Error

wildbill4 — Mon, 28 Sep 2020 12:48:16 GMT

After installing the Sideview_utils and Splunk on Splunk apps getting the following:

Possible typo in stanza [default] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 2: request.ui_context =
Possible typo in stanza [default] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 3: request.ui_edit_view =
Possible typo in stanza [test_saved_search_with_serialized_context_positive] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 11: request.ui_context = group1=per_index_thruput&group2=per_host_thruput&group3=per_sourcetype_thruput&group3=per_source_thruput&group4=per_index_thruput&group5=per_host_thruput&group6=per_sourcetype_thruput&group6=per_source_thruput&group7=per_index_thruput&group8=per_host_thruput&group9=per_sourcetype_thruput&group9=per_source_thruput
Possible typo in stanza [test_saved_search_with_serialized_context_negative] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 21: request.ui_context = group1=per_source_thruput&group2=per_source_thruput&group3=per_source_thruput&group3=per_host_thruput&group4=per_host_thruput&group5=per_source_thruput&group6=per_source_thruput&group6=per_index_thruput&group7=per_source_thruput&group8=per_sourcetype_thruput&group9=per_index_thruput&group9=per_host_thruput
Possible typo in stanza [test_saved_search_for_back_button_cases] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 29: request.ui_context = textfield1=baz3&autoRun=True&pulldown1=foo3&pulldown2=bar3&checkbox=true
There might be typos in your conf files.

Any help would be greatly appreciated.

Re: Sideview_utils/Splunk on Splunk Error

wildbill4 — Wed, 14 Nov 2012 14:40:40 GMT

Also seeing the following when I open the SOS App:

Misconfigured view 'inputs' - Unknown parameter 'level' is defined for module Message. Make sure the parameter is specified in Message.conf.

Re: Sideview_utils/Splunk on Splunk Error

dwaddle — Wed, 14 Nov 2012 15:43:23 GMT

The "possible typos" related to Sideview utils can be safely ignored. Splunk has a "schema" file for each config file telling it what it should expect as far as stanza/key names, and some of Sideview Util's configuration objects are not in that schema.

Re: Sideview_utils/Splunk on Splunk Error

wildbill4 — Wed, 14 Nov 2012 16:38:04 GMT

Thanks for the info

Re: Sideview_utils/Splunk on Splunk Error

hexx — Mon, 19 Nov 2012 17:07:13 GMT

This error message will go away in the next version of SoS.

Re: Sideview_utils/Splunk on Splunk Error

sideview — Mon, 19 Nov 2012 18:31:13 GMT

Splunk provided a mechanism to extend the schema, and Utils follows that mechanism, but some older versions of Splunk still gave the warning regardless. I think on 4.3 and 5.0 these warnings don't happen anymore because Splunk sees the declarations in the readme dir and thus recognizes the stanzas as intentional config rather than typos.