All Apps and Add-ons

Invalid key in stanza "SHOULD_LINEMERGE" of inputs.conf. How to resolve ?

damode
Motivator

getting this error When Splunk runs the process, "checking conf files for problems..." during restart,

Checking: C:\program> files\splunk\etc\apps\TA-meraki\local\inputs.conf
Invalid key in stanza [monitor:///logpartition/2017/meraki/] in C:\program files\splunk\etc\apps\TA-meraki\local\inputs.conf, line 10: SHOULD_LINEMERGE (value:false).
Did you mean 'source'?
Did you mean 'sourcetype'?

Below is what my inputs.conf looks like

[udp://1514]
connection_host = dns
index = meraki
sourcetype = meraki
disabled = 0

[default]
host_segment = 4

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
sourcetype = meraki
index=meraki

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
sourcetype = meraki
index=meraki

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi

It event-braking configuration should be in props.conf.

Can you please create props.conf and configure It?

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false

Please refer below link for more information.

https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Propsconf

0 Karma

damode
Motivator

Hi Kamlesh,

Thanks for your input.

But the instructions from the "details" page of the TA-Meraki app mention that those stanza have to be in inputs.conf. link text

Also, why do we need two stanza if they are both literally the same ?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI damode,

Yes, That's true both are same. I have checked the documentation and you are right.

If we add SHOULD_LINEMERGE under [meraki] stanza after TRANSFORMS-meraki_date_clipper in props.conf instead of inputs.conf ???

[meraki]
.
TRANSFORMS-meraki_date_clipper = meraki_date_clipper
SHOULD_LINEMERGE=false
.
.
.

and It resolved our issue then we can contact the developer of this TA.

Thanks

0 Karma

myron_davis
Path Finder

I apologize for those docs.

I modified the README:
https://github.com/AlaskaSSO/TA-meraki/commit/4bf185dec157e85f0c2facc7b7c6746c26891c3c

At some point in the past I used SHOULD_LINEMERGE=false. I don't even know at this point the case that required it.

damode
Motivator

Thanks, Myron.

As per @kamlesh_vaghela comment, do those stanza have to go in props.conf ?
Also, why do we have two stanzas if they are both same,

[monitor:///logpartition/2017/meraki/]
 SHOULD_LINEMERGE=false

 [monitor:///logpartition/2017/meraki/]
 SHOULD_LINEMERGE=false

Can you please update the "details" page of the app as well ?

thanks!

0 Karma

myron_davis
Path Finder

Sorry about the long delay. I updated the details section of the app.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

🍂 Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...