topic Re: Why do I get "Invalid key in stanza [tcp-ssl://:1470] ... connection_host=dns your indexes and inputs are not internally consistent"? in Getting Data In

Why do I get "Invalid key in stanza [tcp-ssl://:1470] ... connection_host=dns your indexes and inputs are not internally consistent"?

msantich — Mon, 14 Dec 2015 20:53:22 GMT

Hello,

Our /opt/splunk/etc/apps/search/local/inputs.conf file on our forwarder contains:

[tcp-ssl://:1470]
connection_host=dns
sourcetype=apm_log
index=security_logs
queueSize=5MB

When starting the forwarder, I get:

checking for conf file problems:...
invalid key in stanza [tcp-ssl://:1470] in /opt/splunk/etc/apps/search/local/inputs.conf ...connection_host=dns
your indexes and inputs are not internally consistent.

btool output offers no additional information.

Can anyone offer advice?

Thank you so much.

msantich

Re: Why do I get "Invalid key in stanza [tcp-ssl://:1470] ... connection_host=dns your indexes and inputs are not internally consistent"?

lguinn2 — Tue, 15 Dec 2015 00:26:18 GMT

Are you sure that your stanza syntax is correct? As I read inputs.conf.spec, I would think that it should be

[tcp-ssl:1470]

Second, are you sure that there are no special characters, etc. in the connection_host=dns line? Sometimes I find that people cut-and-paste and unusual characters end up in configuration files. Splunk won't like that.

Re: Why do I get "Invalid key in stanza [tcp-ssl://:1470] ... connection_host=dns your indexes and inputs are not internally consistent"?

msantich — Tue, 15 Dec 2015 16:20:18 GMT

Thanks for the input Iguinn.

I tried each of your suggestions and I still get the same error on startup.
I changed the name of the stanza to tcp-ssl:1470 - still get the same error on startup.
I retyped the key-value pair "connection_host=dns" to ensure no special characters and I still get the error on startup.

thanks for your interest in my problem

msantich

Re: Why do I get "Invalid key in stanza [tcp-ssl://:1470] ... connection_host=dns your indexes and inputs are not internally consistent"?

lguinn2 — Tue, 15 Dec 2015 22:53:35 GMT

I am a bit stumped. Perhaps Splunk Support could help?

Re: Why do I get "Invalid key in stanza [tcp-ssl://:1470] ... connection_host=dns your indexes and inputs are not internally consistent"?

nnmiller — Mon, 28 Dec 2015 21:56:47 GMT

splunktcp-ssl and tcp-ssl are two separate input stanza types. splunktcp-ssl is intended for receiving data from Splunk forwarders and allows the key connection_host. tcp-ssl is intended for encrypted communication coming in unparsed (e.g. from 3rd party systems) and does not allow the connection_host key.

Reference: Inputs.conf spec

Re: Why do I get "Invalid key in stanza [tcp-ssl://:1470] ... connection_host=dns your indexes and inputs are not internally consistent"?

TonyLeeVT — Sat, 20 Aug 2016 18:30:19 GMT

I removed connection_host for tcp-ssl and Splunk no longer complained.

Re: Why do I get "Invalid key in stanza [tcp-ssl://:1470] ... connection_host=dns your indexes and inputs are not internally consistent"?

msantich — Mon, 29 Aug 2016 18:43:59 GMT

Thank you all.