All Apps and Add-ons

Invalid key in stanza "SHOULD_LINEMERGE" of inputs.conf. How to resolve ?

damode
Motivator

getting this error When Splunk runs the process, "checking conf files for problems..." during restart,

Checking: C:\program> files\splunk\etc\apps\TA-meraki\local\inputs.conf
Invalid key in stanza [monitor:///logpartition/2017/meraki/] in C:\program files\splunk\etc\apps\TA-meraki\local\inputs.conf, line 10: SHOULD_LINEMERGE (value:false).
Did you mean 'source'?
Did you mean 'sourcetype'?

Below is what my inputs.conf looks like

[udp://1514]
connection_host = dns
index = meraki
sourcetype = meraki
disabled = 0

[default]
host_segment = 4

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
sourcetype = meraki
index=meraki

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
sourcetype = meraki
index=meraki

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi

It event-braking configuration should be in props.conf.

Can you please create props.conf and configure It?

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false

Please refer below link for more information.

https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Propsconf

0 Karma

damode
Motivator

Hi Kamlesh,

Thanks for your input.

But the instructions from the "details" page of the TA-Meraki app mention that those stanza have to be in inputs.conf. link text

Also, why do we need two stanza if they are both literally the same ?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI damode,

Yes, That's true both are same. I have checked the documentation and you are right.

If we add SHOULD_LINEMERGE under [meraki] stanza after TRANSFORMS-meraki_date_clipper in props.conf instead of inputs.conf ???

[meraki]
.
TRANSFORMS-meraki_date_clipper = meraki_date_clipper
SHOULD_LINEMERGE=false
.
.
.

and It resolved our issue then we can contact the developer of this TA.

Thanks

0 Karma

myron_davis
Path Finder

I apologize for those docs.

I modified the README:
https://github.com/AlaskaSSO/TA-meraki/commit/4bf185dec157e85f0c2facc7b7c6746c26891c3c

At some point in the past I used SHOULD_LINEMERGE=false. I don't even know at this point the case that required it.

damode
Motivator

Thanks, Myron.

As per @kamlesh_vaghela comment, do those stanza have to go in props.conf ?
Also, why do we have two stanzas if they are both same,

[monitor:///logpartition/2017/meraki/]
 SHOULD_LINEMERGE=false

 [monitor:///logpartition/2017/meraki/]
 SHOULD_LINEMERGE=false

Can you please update the "details" page of the app as well ?

thanks!

0 Karma

myron_davis
Path Finder

Sorry about the long delay. I updated the details section of the app.

0 Karma
Get Updates on the Splunk Community!

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics GA in US-AWS!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...