topic Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0 in Splunk Enterprise

Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0?

dasadmin — Mon, 21 Nov 2022 12:05:30 GMT

Hello

Upgraded Splunk Enterprise to 9.0.0 today - went OK.

Upgraded Splunk Universal Forwarders on Windows Server 2019 to 9.0.0 - upgrade says all went OK.

I opened cmd and executed splunk restart

The SplunkForwarder restarts OK, but I get the following error:

Invalid key in stanza [webhook] in D:\Program Files\SplunkUniversalForwarder\etc\system\default\alert_actions.conf, line 229: enable_allowlist (value: false)

In the file alert_actions.conf on line 229:

[webhook] enable_allowlist = false

Anyone know why I'm seeing this after the upgrade?

Thanks

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0

isoutamo — Fri, 17 Jun 2022 19:14:22 GMT

at lest I cannot found that parameter from conf file description. Are you sure that you haven’t gotten that warning earlier?

r. Ismo

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0

dasadmin — Fri, 17 Jun 2022 21:26:52 GMT

Hello

I get the message across all the Windows clients when I restart the client:

Error when startingOutput of splunk btool check --debug (pt1)Output of splunk btool check --debug (pt2)

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0

isoutamo — Fri, 17 Jun 2022 21:45:38 GMT

As you get it from etc/system/default directory and you haven't changed it, you should report this to Splunk via support portal.

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0

achavarria — Wed, 22 Jun 2022 19:38:54 GMT

Getting the same issue in my environment after upgrading my universal forwarders to 9.0.0

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0

isoutamo — Thu, 23 Jun 2022 06:39:29 GMT

If this has worked earlier, you should report that to splunk support.

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0

sumedhjoglekar — Wed, 20 Jul 2022 23:53:39 GMT

Were you able to find any solution to this issue ?

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0

dasadmin — Thu, 21 Jul 2022 14:17:19 GMT

hello

I opened a case with splunk and they said don't worry about the error unless it is causing an issue.

It has been forwarded to splunk engineering to look at further.

Thx

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0

tro — Mon, 21 Nov 2022 08:35:35 GMT

I'm so disappointed by Splunk release process that they even don't run "splunk btool check" in their testing pipelines to catch this kind of errors 🙄.

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0

mhanisch_kvd — Mon, 02 Jan 2023 12:38:23 GMT

Happy new year everyone!

I want to ask, if there is an update about this issue? We updated our Splunk Server and universal forwarder to the latest version 9.0.2 yet and ran into the same issue on some machines.

Splunk and the forwarder seems to operate as intended, but we get this errors in the log on some hosts:

Dec 12 15:14:26 somehostname-123 splunk[2268]: Invalid key in stanza [webhook] in /opt/splunkforwarder/etc/system/default/alert_actions.conf, line 229: enable_allowlist (value: false). Dec 12 15:14:26 somehostname-123 splunk[2268]: Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0

tro — Mon, 02 Jan 2023 13:50:47 GMT

I got this answer via official Splunk support:

Ticket raised to our developers: SPL-229404.

In general fix in new app version was already implemented. But app is still not ready to be released due to some other things which have to be tested.
Unfortunately I don't have any specific ETA for now but I believe it should not take too long.

So I would suggest watch SPL-229404 in upcoming changelogs.

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0?

ivarbaba — Mon, 13 Mar 2023 06:27:25 GMT

I have the same problem. Did you get a fix?

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0?

tro — Mon, 13 Mar 2023 07:21:52 GMT

You you are having same issue, then it is fixed in version Splunk 9.0.4. Please do update 😉

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0

lbdatpsu — Tue, 25 Apr 2023 19:57:05 GMT

Fwiw, the problem is still there in UF 9.0.4.

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0

chadmedeiros — Wed, 26 Apr 2023 14:38:52 GMT

Honestly. Nearly 1 year later and 2 version revisions and every fresh UF install done on every server throws this out-of-the-box warning. Not at all impressed

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0?

chadmedeiros — Wed, 26 Apr 2023 14:39:41 GMT

this is not fixed in 9.0.4

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0?

Skeer-Jamf — Mon, 17 Jul 2023 16:45:59 GMT

Getting this error when either: installing fresh 9.1.0.1 or upgrading 8.x to 9.1. This is just sad.. I mean how could Splunk have NOT fixed this in over a year??

Obviously the syntax changed.. can't be that hard to figure out why.

Re: Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0?

computermathguy — Mon, 02 Oct 2023 18:24:10 GMT

Getting the same warning. I'll submit a support ticket.