topic Re: Splunk 9.x Invalid Stanza in `federated.conf` in Splunk Enterprise

Does anyone know a fix for Splunk 9.x Invalid Stanza in `federated.conf`?

morethanyell — Wed, 20 Jul 2022 21:17:10 GMT

Newly released Splunk 9 introduced an error or invalid stanza on `federated.conf`. Anybody knows how to fix this?

Invalid key in stanza [provider:splunk] in /opt/splunk/etc/system/default/federated.conf, line 20: mode (value: standard). Invalid key in stanza [general] in /opt/splunk/etc/system/default/federated.conf, line 23: needs_consent (value: true).

Re: Splunk 9.x Invalid Stanza in `federated.conf`

isoutamo — Tue, 21 Jun 2022 07:27:58 GMT

quite interesting as I have both of those in place and didn't got any errors!

[soutamo@fer] ~> (0) $ splunk btool check [soutamo@fer] ~> (0) $ splunk btool federated list --debug /opt/splunk/9.0.0/splunk/etc/system/default/federated.conf [default] /opt/splunk/9.0.0/splunk/etc/system/default/federated.conf [general] /opt/splunk/9.0.0/splunk/etc/system/default/federated.conf needs_consent = true /opt/splunk/9.0.0/splunk/etc/system/default/federated.conf [provider:splunk] /opt/splunk/9.0.0/splunk/etc/system/default/federated.conf appContext = search /opt/splunk/9.0.0/splunk/etc/system/default/federated.conf mode = standard /opt/splunk/9.0.0/splunk/etc/system/default/federated.conf type = splunk /opt/splunk/9.0.0/splunk/etc/system/default/federated.conf useFSHKnowledgeObjects = false [soutamo@fer] ~> (0) $

What you will gotten when you are running those two commands?

r. Ismo

Re: Splunk 9.x Invalid Stanza in `federated.conf`

morethanyell — Tue, 21 Jun 2022 16:09:16 GMT

This is what I get.

Re: Splunk 9.x Invalid Stanza in `federated.conf`

zrxcrasher — Tue, 21 Jun 2022 17:47:10 GMT

I am getting that exact same set of errors as the original author on a basic 8.2.4 deployment server.

Re: Splunk 9.x Invalid Stanza in `federated.conf`

isoutamo — Tue, 21 Jun 2022 18:06:18 GMT

Can you check e.g. with od that this file is not corrupted and contains some additional control character?

od -t c -t x1

I cannot test those parameters, but please check those from man page.

Re: Splunk 9.x Invalid Stanza in `federated.conf`

norbertt911 — Fri, 24 Jun 2022 10:34:29 GMT

Hi,

I got the exact same error after upgrading 8.2.6.

splunk btool check --debug

...

Checking: /opt/splunk/etc/system/default/federated.conf
Invalid key in stanza [provider:splunk] in /opt/splunk/etc/system/default/federated.conf, line 20: mode (value: standard).
Invalid key in stanza [general] in /opt/splunk/etc/system/default/federated.conf, line 23: needs_consent (value: true).

...

splunk btool federated list --debug
/opt/splunk/etc/system/default/federated.conf [default]
/opt/splunk/etc/system/default/federated.conf [general]
/opt/splunk/etc/system/default/federated.conf needs_consent = true
/opt/splunk/etc/system/default/federated.conf [provider:splunk]
/opt/splunk/etc/system/default/federated.conf appContext = search
/opt/splunk/etc/system/default/federated.conf mode = standard
/opt/splunk/etc/system/default/federated.conf type = splunk
/opt/splunk/etc/system/default/federated.conf useFSHKnowledgeObjects = false

any idea?

Re: Splunk 9.x Invalid Stanza in `federated.conf`

norbertt911 — Fri, 24 Jun 2022 15:57:38 GMT

Hi,

Correct me if I'm wrong but "mode" and "needs_consent" value definitions are missing from .../system/README/federated.conf.example and federated.conf.spec.

I think that causing the issue.

Re: Does anyone know w a fix for Splunk 9.x Invalid Stanza in `federated.conf`?

joshiro — Mon, 27 Jun 2022 15:46:46 GMT

We found out that the current Splunk 9 Enterprise OnPrem tarfile updates the /etc/system/default/federated.conf file with new options/keys but they arent including the associated spec file in /etc/system/README/federated.conf.spec or the example file in /etc/system/README/federated.conf.example.

So it is using the previous version of both spec and example files if you are upgrading, or none if it is a clean install.

Also there is no information about the 9.0.0 federated.conf.spec in the conf files reference section of the online admin manual (there are entries for older versions https://docs.splunk.com/Documentation/Splunk/8.2.6/Admin/Federatedconf), so we cant generate the fixed spec file.

We could add these missing options/keys into the spec file (assuming the spec is broken), or we could use the 8.2.6 federated.conf file that works (assuming the current one is broken).
Any ideas about this issue? or official responses from Splunk about this?

Re: Does anyone know w a fix for Splunk 9.x Invalid Stanza in `federated.conf`?

isoutamo — Mon, 27 Jun 2022 17:20:37 GMT

If you are needing those options then add those to spec file otherwise remove/comment those. Anyway you should create a support case to splunk, that they could fix it for future versions.

Re: Does anyone know w a fix for Splunk 9.x Invalid Stanza in `federated.conf`?

zrxcrasher — Mon, 27 Jun 2022 17:58:07 GMT

This is not something I configured intentionally. This is the direct result of upgrade from Splunk 8.2.4 to 9.0.0.

Re: Does anyone know w a fix for Splunk 9.x Invalid Stanza in `federated.conf`?

mskrzynski — Mon, 18 Jul 2022 18:35:00 GMT

Hello,

I have the same error after upgrade from 8.2.7.

./splunk btool check --debug

Checking: /opt/splunk/etc/system/default/federated.conf

Invalid key in stanza [provider:splunk] in /opt/splunk/etc/system/default/federated.conf, line 20: mode (value: standard).

Invalid key in stanza [general] in /opt/splunk/etc/system/default/federated.conf, line 23: needs_consent (value: true).

I’ve made some research on fresh 9.0.0 install doesn’t have this file.

/opt/splunk/bin# ./splunk btool check --debug | grep fede

No spec file for: /opt/splunk/etc/system/default/federated.conf

So it looks like an after upgrade issue.

Re: Does anyone know w a fix for Splunk 9.x Invalid Stanza in `federated.conf`?

mskrzynski — Mon, 18 Jul 2022 18:55:14 GMT

Hi again,

Fresh 9.0.0 install

find $SPLUNK_HOME/ -name federated.conf*

/opt/splunk/var/run/splunk/confsnapshot/baseline_default/system/default/federated.conf

/opt/splunk/etc/system/default/federated.conf

8.2.7 -> 9.0.0 install

find $SPLUNK_HOME/ -name federated.conf*

/opt/splunk/etc/system/README/federated.conf.spec

/opt/splunk/etc/system/README/federated.conf.example

/opt/splunk/etc/system/default/federated.conf

/opt/splunk/var/run/splunk/confsnapshot/baseline_default/system/default/federated.conf

root@srvslprosplunk1:/opt# mv /opt/splunk/etc/system/README/federated.conf.spec /home/splunk/

root@srvslprosplunk1:/opt# mv /opt/splunk/etc/system/README/federated.conf.example /home/splunk/

root@srvslprosplunk1:/opt# splunk/bin/splunk btool check –debug | grep fede

No spec file for: /opt/splunk/etc/system/default/federated.conf

/etc/inid.d/splunk start

…

Splunk> Finding your faults, just like mom.

Checking prerequisites...

Checking http port [8000]: open

Checking mgmt port [8089]: open

Checking appserver port [127.0.0.1:8065]: open

All preliminary checks passed.

…

Starting splunk server daemon (splunkd)...

If you get stuck, we're here to help.

Look for answers here: http://docs.splunk.com

The Splunk web interface is at https://xxx:8000

Works fine.

Re: Does anyone know w a fix for Splunk 9.x Invalid Stanza in `federated.conf`?

norbertt911 — Tue, 19 Jul 2022 14:30:19 GMT

Hi,

No offense, but he first rule of Splunk, that

/opt/splunk/etc/system/README/

/opt/splunk/etc/system/default

folders and content should be not modified. This is should be done by the Splunk support in a new release. I understand that the do-it-yourself way faster, but in the future, you can have unexpected behavior.

Re: Does anyone know w a fix for Splunk 9.x Invalid Stanza in `federated.conf`?

mskrzynski — Wed, 20 Jul 2022 10:02:59 GMT

Hi,

I understand and agree with You.

But fresh install doesn’t have federated in README…

Best regards M.

Re: Does anyone know a fix for Splunk 9.x Invalid Stanza in `federated.conf`?

miteshp250283 — Mon, 15 Aug 2022 03:28:17 GMT

I had the same problem and I could get rid of that error by renaming "federated.conf.spec" file from $SPLUNK_HOME/etc/system/README path.

Please upvote if this helpful.

Thanks, Mitesh.