getting this error When Splunk runs the process, "checking conf files for problems..." during restart,
Checking: C:\program> files\splunk\etc\apps\TA-meraki\local\inputs.conf
Invalid key in stanza [monitor:///logpartition/2017/meraki/] in C:\program files\splunk\etc\apps\TA-meraki\local\inputs.conf, line 10: SHOULD_LINEMERGE (value:false).
Did you mean 'source'?
Did you mean 'sourcetype'?
Below is what my inputs.conf looks like
[udp://1514]
connection_host = dns
index = meraki
sourcetype = meraki
disabled = 0[default]
host_segment = 4[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
sourcetype = meraki
index=meraki[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
sourcetype = meraki
index=meraki
Hi
It event-braking configuration should be in props.conf.
Can you please create props.conf and configure It?
[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
Please refer below link for more information.
https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Propsconf
Hi Kamlesh,
Thanks for your input.
But the instructions from the "details" page of the TA-Meraki app mention that those stanza have to be in inputs.conf. link text
Also, why do we need two stanza if they are both literally the same ?
HI damode,
Yes, That's true both are same. I have checked the documentation and you are right.
If we add SHOULD_LINEMERGE under [meraki] stanza after TRANSFORMS-meraki_date_clipper in props.conf instead of inputs.conf ???
[meraki]
.
TRANSFORMS-meraki_date_clipper = meraki_date_clipper
SHOULD_LINEMERGE=false
.
.
.
and It resolved our issue then we can contact the developer of this TA.
Thanks
I apologize for those docs.
I modified the README:
https://github.com/AlaskaSSO/TA-meraki/commit/4bf185dec157e85f0c2facc7b7c6746c26891c3c
At some point in the past I used SHOULD_LINEMERGE=false. I don't even know at this point the case that required it.
Thanks, Myron.
As per @kamlesh_vaghela comment, do those stanza have to go in props.conf ?
Also, why do we have two stanzas if they are both same,
[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
Can you please update the "details" page of the app as well ?
thanks!
Sorry about the long delay. I updated the details section of the app.