topic Re: Invalid key within a stanza? in Getting Data In

Invalid key within a stanza?

jaburke1 — Fri, 23 Aug 2024 17:14:43 GMT

Is there a way to get a list of valid keys for a stanza?

For example: If you get "Invalid key in stanza" for something like:

[file_integrity]
exclude = /file/path

It doesn't like the "exclude" but is there an alternative "key" value to accomplish the same? Thanks in advance!

Re: Invalid key within a stanza?

richgalloway — Mon, 26 Aug 2024 12:17:48 GMT

Valid keys are documented in the related .spec file in $SPLUNK_HOME/etc/system/README. For instance, for the keys for props.conf see $SPLUNK_HOME/etc/system/README/props.conf.spec.

You also can find the information in the Admin Manual.

Re: Invalid key within a stanza?

jaburke1 — Mon, 26 Aug 2024 10:20:56 GMT

Thank you very much @richgalloway !

Re: Invalid key within a stanza?

richgalloway — Mon, 26 Aug 2024 12:18:12 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

Re: Invalid key within a stanza?

PickleRick — Mon, 26 Aug 2024 12:25:43 GMT

One caveat - there are occasionally situations (especially with newly introduced features) that the .spec file does not contain proper entry. It doesn't happen often but it does happen sometimes.

Re: Invalid key within a stanza?

jaburke1 — Mon, 26 Aug 2024 13:14:47 GMT

Thank you @PickleRick