topic Why am I getting error message 'invalid key in stanza' after installing a universal forwarder? in Getting Data In

Why am I getting error message 'invalid key in stanza' after installing a universal forwarder?

ford1863 — Thu, 21 Aug 2014 08:53:26 GMT

Hi All,

When I installed the splunk universal forwarder on my linux server and restarted the splunk service, there run an error like below:'Invalid key in stanza [monitor:///tmp/nohup_1.out] in /opt/splunkforwarder/etc/system/local/inputs.conf, line 5: disable (value: 0)'. Was it a normal message? I need your help!

Thanks,
Henry

Re: Why am I getting error message 'invalid key in stanza' after installing a universal forwarder?

MuS — Thu, 21 Aug 2014 09:05:27 GMT

Hi ford1863,

change disable to disabled in inputs.conf monitor stanza.

hope this helps ...

cheers, MuS

Re: Why am I getting error message 'invalid key in stanza' after installing a universal forwarder?

Ayn — Thu, 21 Aug 2014 09:06:22 GMT

It is what it says - you have an invalid key in your inputs.conf. It's supposed to be "disabled", not "disable". On the other hand, the default for that value is 0 anyway, so it won't make a difference - the stanza should be applied anyway.