topic Where is the invalid key in my inputs.conf? in Getting Data In

Where is the invalid key in my inputs.conf?

cburgman — Thu, 14 Jun 2018 14:49:19 GMT

Receiving:
Invalid key in stanza [monitor://D:\\radiantone\\vds\\vds_server\\logs] in , line 6: whitelist1 (value: vds_server.*\.log). Invalid key in stanza [monitor://D:\\radiantone\\vds\\vds_server\\logs] in <c:\Program Files\SplunkUniversalForwarder\etc\apps\bsw_vds_inputs\local\inputs.conf>, line 7: whitelist2 (value: vds_server\.log).

Here is the inputs.conf:

[monitor://D:\\radiantone\\vds\\vds_server\\logs]
index=vds_logs
sourcetype=VDS_define_sourcetype
whitelist=vds_server_\d{4}-\d{2}-\d{2}.*\.log
whitelist1=vds_server.*\.log
whitelist2=vds_server\.log

Re: Where is the invalid key in my inputs.conf?

lacastillo — Thu, 14 Jun 2018 14:59:52 GMT

I don't see mistake yet but here are the docs I'm referencing. Hope this helps.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Inputsconf#Event_Log_whitelist_and_blacklist_formats

Re: Where is the invalid key in my inputs.conf?

lacastillo — Thu, 14 Jun 2018 15:15:00 GMT

It looks like you're trying to use the whitelists in inputs.conf as a means of specifying which files to monitor when it's meant to be used as a means of whitelisting specific events within a monitored file. I believe you would just need a separate monitoring stanza for each of your whitelisted values.

Let me know if this helped.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Inputsconf#MONITOR:

Re: Where is the invalid key in my inputs.conf?

cburgman — Thu, 14 Jun 2018 15:53:38 GMT

You are correct... I added an additional stanza and now I am seeing logs. Thanks!

Re: Where is the invalid key in my inputs.conf?

lacastillo — Thu, 14 Jun 2018 16:27:21 GMT

You're very welcome!