topic Re: getting typos message on universal forwarder in Getting Data In

getting typos message on universal forwarder

keshab — Mon, 14 Nov 2011 14:57:00 GMT

Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 3: autoLBUseDNS  =  false
Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 4: backoffOnFailure  =  30
Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 6: blockOnQueueFull  =  true
Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 9: disableBackoffOnFailure  =  false
Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 11: dropClonedEventsOnQueueFull  =  5
Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 17: maxPersistentQueueSizeInMegs  =  1024
Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 18: persistentQueuePath  =  /usr/local/splunkforwarder/var/run/splunk/persistent_tcp_queue
Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 19: readTimeout  =  300
Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 22: splunktcpVersion  =  --splunk-cooked-mode-v2--
Possible typo in stanza [tcpout] in /usr/local/splunkforwarder/etc/apps/SplunkUniversalForwarder/local/outputs.conf, line 25: usePersistentQueue  =  false
There might be typos in your conf files. For more information, run 'splunk btool check --debug'

Re: getting typos message on universal forwarder

Drainy — Mon, 14 Nov 2011 15:20:44 GMT

Just glancing over a few of the lines is it possible there are some hidden characters in there?
I've had experiences where there are characters hidden out of sight which affect it but Splunk still detects them so it causes some corruption of its interpretation of it.

Perhaps try deleting those lines and typing them back in again to see if it makes any difference?

Re: getting typos message on universal forwarder

Kate_Lawrence-G — Mon, 14 Nov 2011 15:23:04 GMT

can you post a copy of the outputs.conf?

Re: getting typos message on universal forwarder

MHibbin — Mon, 14 Nov 2011 15:27:33 GMT

to ask the obvious have you tried running

$SPLUNK_HOME/bin/splunk btool check --debug

It can actually be quite helpful.

Can you add the outputs.conf file on here?

Re: getting typos message on universal forwarder

keshab — Mon, 28 Sep 2020 10:06:19 GMT

Here is my outputs.conf file

[tcpout]
autoLBFrequency = 30

autoLBUseDNS = false

backoffOnFailure = 30

blockOnCloning = true

blockOnQueueFull = true

connectionTimeout = 20

disableBackoffOnFailure = false

dnsResolutionInterval = 300

dropClonedEventsOnQueueFull = -1

dropEventsOnQueueFull = -1

heartbeatFrequency = 30

indexAndForward = false

maxConnectionsPerIndexer = 2

maxFailuresPerInterval = 2

maxPersistentQueueSizeInMegs = 1024

persistentQueuePath = /usr/local/splunkforwarder/var/run/splunk/persistent_tcp_queue

readTimeout = 300

secsInFailureInterval = 1

sendCookedData = true

splunktcpVersion = --splunk-cooked-mode-v2--

sslPassword = $1$AVW9Xuv9d+0P

useACK = false

usePersistentQueue = false

writeTimeout = 300

Re: getting typos message on universal forwarder

kristian_kolb — Tue, 15 Nov 2011 09:42:18 GMT

There is no such directive as

autoLBUseDNS = false

That's why it is considered a typo. You should probably check out the docs for outputs.conf

regards,

Kristian

Re: getting typos message on universal forwarder

keshab — Tue, 15 Nov 2011 20:23:17 GMT

splunk start/restart automatically adds those entry. It's not my manual entry. where can I configure so that start/restart will not add those entry??

Re: getting typos message on universal forwarder

kristian_kolb — Wed, 16 Nov 2011 13:19:24 GMT

just edit the outputs.conf file on the forwarder. I don't think this is automatically added/changed by starting/stopping the forwarder. Check the documentation for outputs.conf to see valid configuration options.