topic Why does Universal Forwarders complain about missing stanza [distributedSearch] in distsearch.conf? in Monitoring Splunk

Why does Universal Forwarders complain about missing stanza [distributedSearch] in distsearch.conf?

vgrote — Thu, 19 Jan 2023 18:19:17 GMT

Running the Customer Success Toolkit's error report I noticed a warning on lots of Universal Forwarders that doesn't make sense to me:

19.01.23 10:49:53,614

01-19-2023 10:49:53.614 +0100 WARN UserManagerPro - Can't find [distributedSearch] stanza in distsearch.conf, using default authtoken HTTP timeouts

host = Unix Box
source = /opt/forwarder/data/var/log/splunk/splunkd.log
sourcetype = splunkd

19.01.23 10:33:28,659

01-19-2023 10:33:28.659 +0100 WARN UserManagerPro - Can't find [distributedSearch] stanza in distsearch.conf, using default authtoken HTTP timeouts

host = Windows Box
source = C:\Program Files\Splunk\UniversalForwarder\var\log\splunk\splunkd.log
sourcetype = splunkd

Our Universal Forwarders have no distsearch.conf.

Any idea why this is reported?

And how to turn it off? We already have enough noise in our data.

Thanks in advance

Volkmar

Re: Universal Forwarders complain@vgr about missing stanza [distributedSearch] in distsearch.conf

PaulPanther — Thu, 19 Jan 2023 11:09:38 GMT

@vgrote It is a useless Warning for UniversalForwarder. As a workaround to get rid of these log messages you could roll out a distsearch.conf file that contains only the stanza

[distributedSearch]

Re: Why does Universal Forwarders complain about missing stanza [distributedSearch] in distsearch.conf?

Mahadev_Nanda — Sat, 21 Jan 2023 16:20:59 GMT

Hi @vgrote ,

Have you checked this https://community.splunk.com/t5/Getting-Data-In/Unable-to-find-distsearch-conf-file-on-my-system-and-it-is/m-p/270007. I’m not 100 sure, but looks like it may help.

Thank You