topic Re: Invalid key-value parser, ignoring it, transform_name='leef_header' in All Apps and Add-ons

Invalid key-value parser, ignoring it, transform_name='leef_header'

ChrisBell04 — Tue, 29 Sep 2020 22:52:35 GMT

FYI

The latest 1.0.14 app has some invalid configs in props/transforms. Splunkd.log complains about the following:

WARN  SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='leef_header'
WARN  SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='leef_body'

Neither leef_header or leef_body stanzas are in transforms.conf, which are being used by:

REPORT-leef_data = leef_header, leef_body

Any plans on separating this out into a dedicated addon and app?

Re: Invalid key-value parser, ignoring it, transform_name='leef_header'

prakash007 — Fri, 18 Jan 2019 18:27:16 GMT

@ChrisBell04 : how's your props and transforms look like..??
run this to check for any invalid configs$SPLUNK_HOME/bin/splunk btool check

Re: Invalid key-value parser, ignoring it, transform_name='leef_header'

ChrisBell04 — Fri, 18 Jan 2019 18:38:45 GMT

a fresh download of the app from splunkbase, has the invalid entries splunk is complaining about. There are no leef_ stanzas in transforms.conf. yes, its an easy fix... reporting it so the author will eventually correct.

\VormetricDataSecurityLite\default\props.conf
[leef]
TRANSFORMS-syslog = test_for_syslog
TRANSFORMS-unknown = test_for_not_leef
TRANSFORMS-host = leef_host
REPORT-leef_data = leef_header, leef_body
SHOULD_LINEMERGE = false
TIME_PREFIX = devTime=
TIME_FORMAT = %Y-%m-%dT%H.%M.%S.%3N%z
MAX_TIMESTAMP_LOOKAHEAD = 30
TZ = UTC