topic Re: what is this typos in outputs.conf ? in Getting Data In

what is this typos in outputs.conf ?

sieutruc — Thu, 27 Sep 2012 15:35:28 GMT

Hello

I got a strange error as:

Checking conf files for typos...
Possible typo in stanza [indexAndForward] in /opt/splunk/etc/apps/linuxForwarder_output/default/outputs.conf, line 8: selectiveIndexing = true
There might be typos in your conf files. For more information, run 'splunk btool check --debug'

and my outputs.conf is



[tcpout]

defaultGroup = noforward

disabled=false

[indexAndForward]

index=true

selectiveIndexing=true

[tcpout:indexer01]

server=178.17.0.46:9997

[tcpout:indexer02]

server=178.17.0.47:9997

Can you show me why ? i just only copied the word and it seems not to have any erro

Re: what is this typos in outputs.conf ?

yannK — Thu, 27 Sep 2012 16:04:30 GMT

The configurations typo check is compared to the spec files stored in system/README, example for outputs.conf
$SPLUNK_HOME/etc/system/README/outputs.conf.spec

I checked the spec and the parameter "selectiveIndexing" is not listed. While it is mentioned on the documentation there : http://docs.splunk.com/Documentation/Splunk/4.3.4/Deploy/Routeandfilterdatad
It may be an obscure missing parameter in the spec, or a mistake in the docs, let me open a bug to find out.

Except the typo warning, is your configuration working ?

Re: what is this typos in outputs.conf ?

bmacias84 — Mon, 28 Sep 2020 12:31:14 GMT

@sieutruc, I don't see anything outright. You could have a char outside the standard unicode table causing Splunk to choke. Also have you edited your inputs.conf to have explicity target groups, but I am guessing you are not getting that far.

I would try using:



./splunk cmd btool check -dir=/opt/splunk/etc/apps/linuxForwarder_output/default outputs --debug



./splunk cmd btool dir=/opt/splunk/etc/apps/linuxForwarder_output/default outputs list --debug

This might help display where exactly.

Usebtooltotroubleshootconfigurations

Note: btool is not tested by Splunk and is not officially supported or guaranteed. That said, it's what our Support team uses when trying to troubleshoot your issues.

Hope this helps.

Re: what is this typos in outputs.conf ?

sieutruc — Thu, 27 Sep 2012 17:53:11 GMT

Yes, i did. I configured the inputs.conf to have explicit target groups. I let all configuration file in my office. In fact, i don't understand why it caused an error. I see it run in splunkd log, but without sending externally or locally indexing.
I used winscp edit tool that runs fine until now, just only this time got a problem.
Maybe i'll contact Splunk support if it doesn't work

Re: what is this typos in outputs.conf ?

sieutruc — Mon, 28 Sep 2020 12:31:20 GMT

all the configuration worked, the data go from another Universal Forwarder to that machine is transfered to indexer01 and indexer02. But the local input data that i used in inputs.conf:
[inputdata]
_TCP_ROUTING = indexer01
it doesn't be sent to indexer01
that all what i want to say

Re: what is this typos in outputs.conf ?

yannK — Fri, 28 Sep 2012 00:40:18 GMT

I confirm this seems to be a bug in 4.3.*, the ref is SPL-55915

Re: what is this typos in outputs.conf ?

sieutruc — Mon, 01 Oct 2012 11:21:02 GMT

So what should i do now ? do i need to update Splunk instance ?