topic Splunk App for Windows Infrastructure: After upgrading to Splunk 6.3.3, why am I getting "Your indexes and inputs configurations are not internally consistent"? in All Apps and Add-ons

Splunk App for Windows Infrastructure: After upgrading to Splunk 6.3.3, why am I getting "Your indexes and inputs configurations are not internally consistent"?

swasserroth — Thu, 11 Feb 2016 09:42:19 GMT

Hi,

After upgrading to Splunk 6.3.3, the following problem is displayed when starting Splunk:

Checking conf files for problems...
            Invalid key in stanza [ui] in /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/app.conf, line 15: attribution_link  (value:  app.attributions).
            Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'

Does anybody know how to solve the problem?
Thanks!

Re: Splunk App for Windows Infrastructure: After upgrading to Splunk 6.3.3, why am I getting "Your indexes and inputs configurations are not internally consistent"?

dlpco — Wed, 17 Feb 2016 03:32:14 GMT

Did you get an answer offline about this. I have the same issue.

Re: Splunk App for Windows Infrastructure: After upgrading to Splunk 6.3.3, why am I getting "Your indexes and inputs configurations are not internally consistent"?

swasserroth — Wed, 17 Feb 2016 07:36:04 GMT

no answer yet 😞
problem still exists.

Re: Splunk App for Windows Infrastructure: After upgrading to Splunk 6.3.3, why am I getting "Your indexes and inputs configurations are not internally consistent"?

AlbintEIG — Wed, 17 Feb 2016 13:17:52 GMT

Same issue here.

Re: Splunk App for Windows Infrastructure: After upgrading to Splunk 6.3.3, why am I getting "Your indexes and inputs configurations are not internally consistent"?

srunyon — Wed, 17 Feb 2016 13:46:03 GMT

Same issue.

Re: Splunk App for Windows Infrastructure: After upgrading to Splunk 6.3.3, why am I getting "Your indexes and inputs configurations are not internally consistent"?

mattspierce — Tue, 29 Sep 2020 08:50:36 GMT

I am also getting this error. In my case both the app for nix and app for windows are generating it.

Invalid key in stanza [ui] in /opt/splunk/etc/apps/splunk_app_for_nix/default/app.conf, line 18: attribution_link (value: app.attributions).
Invalid key in stanza [ui] in /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/app.conf, line 15: attribution_link (value: app.attributions).

Re: Splunk App for Windows Infrastructure: After upgrading to Splunk 6.3.3, why am I getting "Your indexes and inputs configurations are not internally consistent"?

jwelch_splunk — Fri, 19 Feb 2016 21:24:22 GMT

When splunk starts.... It compares the app.conf file against app.conf.spec files. It would seem that you have a key under the [UI] stanza in the app.conf that is not listed as a valid key under the [UI] stanza in the app.conf.spec file.

So from /opt/splunk/etc/

find . -name app.conf.spec |xargs grep app.attributions OR however you would do this in windows.....

If you don't see that Key in any app.conf.spec file then you will get this error upon startup.

I am looking into this to see what I can find out. I will post back when I understand which bit was missed, but from the initial look it seems we are missing a part of the app.conf.spec file. I will file a bug and let you know the outcome.

Re: Splunk App for Windows Infrastructure: After upgrading to Splunk 6.3.3, why am I getting "Your indexes and inputs configurations are not internally consistent"?

jwelch_splunk — Tue, 23 Feb 2016 04:08:43 GMT

This issue has been confirmed, the warnings are expected and we will document this as a known issue. The app.conf.spec is scheduled to be addressed in a future release.

You can safely ignore the warning at present.

Re: Splunk App for Windows Infrastructure: After upgrading to Splunk 6.3.3, why am I getting "Your indexes and inputs configurations are not internally consistent"?

swasserroth — Tue, 23 Feb 2016 07:31:08 GMT

See last comment of jwelch_splunk: Issue has been confirmed, warning should be ignored
This closes the issue -- Thank you!