All Apps and Add-ons

Invalid key in stanza "SHOULD_LINEMERGE" of inputs.conf. How to resolve ?

damode
Motivator

getting this error When Splunk runs the process, "checking conf files for problems..." during restart,

Checking: C:\program> files\splunk\etc\apps\TA-meraki\local\inputs.conf
Invalid key in stanza [monitor:///logpartition/2017/meraki/] in C:\program files\splunk\etc\apps\TA-meraki\local\inputs.conf, line 10: SHOULD_LINEMERGE (value:false).
Did you mean 'source'?
Did you mean 'sourcetype'?

Below is what my inputs.conf looks like

[udp://1514]
connection_host = dns
index = meraki
sourcetype = meraki
disabled = 0

[default]
host_segment = 4

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
sourcetype = meraki
index=meraki

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
sourcetype = meraki
index=meraki

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi

It event-braking configuration should be in props.conf.

Can you please create props.conf and configure It?

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false

Please refer below link for more information.

https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Propsconf

0 Karma

damode
Motivator

Hi Kamlesh,

Thanks for your input.

But the instructions from the "details" page of the TA-Meraki app mention that those stanza have to be in inputs.conf. link text

Also, why do we need two stanza if they are both literally the same ?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI damode,

Yes, That's true both are same. I have checked the documentation and you are right.

If we add SHOULD_LINEMERGE under [meraki] stanza after TRANSFORMS-meraki_date_clipper in props.conf instead of inputs.conf ???

[meraki]
.
TRANSFORMS-meraki_date_clipper = meraki_date_clipper
SHOULD_LINEMERGE=false
.
.
.

and It resolved our issue then we can contact the developer of this TA.

Thanks

0 Karma

myron_davis
Path Finder

I apologize for those docs.

I modified the README:
https://github.com/AlaskaSSO/TA-meraki/commit/4bf185dec157e85f0c2facc7b7c6746c26891c3c

At some point in the past I used SHOULD_LINEMERGE=false. I don't even know at this point the case that required it.

damode
Motivator

Thanks, Myron.

As per @kamlesh_vaghela comment, do those stanza have to go in props.conf ?
Also, why do we have two stanzas if they are both same,

[monitor:///logpartition/2017/meraki/]
 SHOULD_LINEMERGE=false

 [monitor:///logpartition/2017/meraki/]
 SHOULD_LINEMERGE=false

Can you please update the "details" page of the app as well ?

thanks!

0 Karma

myron_davis
Path Finder

Sorry about the long delay. I updated the details section of the app.

0 Karma
Get Updates on the Splunk Community!

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...