topic Re: Invalid key in stanza [Splunk_TA_f5_bigip_main] in All Apps and Add-ons

Invalid key in stanza [Splunk_TA_f5_bigip_main]

gduggan1 — Tue, 29 Sep 2020 09:12:24 GMT

I am running Splunk 6.3.3 and F5 TA 2.4.0 and getting the following error. Anyone seen this before? I am still indexing data from F5 so it can't be too critical....

Invalid key in stanza [Splunk_TA_f5_bigip_main] in /opt/splunk/etc/apps/Splunk_TA_f5-bigip/default/inputs.conf, line 12: start_by_shell (value: false).

btool debug
Checking: /opt/splunk/etc/apps/Splunk_TA_f5-bigip/default/app.conf
No spec file for: /opt/splunk/etc/apps/Splunk_TA_f5-bigip/default/eventgen.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_f5-bigip/default/eventtypes.conf
No spec file for: /opt/splunk/etc/apps/Splunk_TA_f5-bigip/default/f5_bigip_templates.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_f5-bigip/default/inputs.conf
Invalid key in stanza [Splunk_TA_f5_bigip_main] in /opt/splunk/etc/apps/Splunk_TA_f5-bigip/default/inputs.conf, line 12: start_by_shell (value: false).
Did you mean 'source'?
Did you mean 'sourcetype'?
No spec file for: /opt/splunk/etc/apps/Splunk_TA_f5-bigip/default/log_info.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_f5-bigip/default/props.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_f5-bigip/default/tags.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_f5-bigip/default/transforms.conf
Checking: /opt/splunk/etc/apps/Splunk_TA_f5-bigip/default/web.conf

Re: Invalid key in stanza [Splunk_TA_f5_bigip_main]

michael_kushma — Thu, 24 Mar 2016 20:00:14 GMT

Can we see the inputs.conf in question?

Re: Invalid key in stanza [Splunk_TA_f5_bigip_main]

gduggan1 — Tue, 29 Sep 2020 09:12:29 GMT

inputs.conf

[udp://9514]
disabled = false
connection_host=ip
sourcetype = f5:bigip:syslog

[tcp://9515]
disabled = false
connection_host=ip
sourcetype = f5:bigip:syslog

[Splunk_TA_f5_bigip_main]
start_by_shell = false

Re: Invalid key in stanza [Splunk_TA_f5_bigip_main]

maikfischer — Tue, 29 Sep 2020 09:15:52 GMT

Hi,

as start_by_shell is an option for a script-stanza, try to rename the stanza "[Splunk_TA_f5_bigip_main]" to "[script://./bin/Splunk_TA_f5_bigip_main.py]".

regards,

Maik

Re: Invalid key in stanza [Splunk_TA_f5_bigip_main]

gduggan1 — Tue, 29 Mar 2016 15:17:07 GMT

Thank you very much!

Re: Invalid key in stanza [Splunk_TA_f5_bigip_main]

jmantor — Fri, 28 Jul 2017 14:46:06 GMT

This stanza is still broken in version 2.5.0 of this app.
Could this get fixed upstream, please?