All Apps and Add-ons

Invalid key in stanza "SHOULD_LINEMERGE" of inputs.conf. How to resolve ?

damode
Motivator

getting this error When Splunk runs the process, "checking conf files for problems..." during restart,

Checking: C:\program> files\splunk\etc\apps\TA-meraki\local\inputs.conf
Invalid key in stanza [monitor:///logpartition/2017/meraki/] in C:\program files\splunk\etc\apps\TA-meraki\local\inputs.conf, line 10: SHOULD_LINEMERGE (value:false).
Did you mean 'source'?
Did you mean 'sourcetype'?

Below is what my inputs.conf looks like

[udp://1514]
connection_host = dns
index = meraki
sourcetype = meraki
disabled = 0

[default]
host_segment = 4

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
sourcetype = meraki
index=meraki

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
sourcetype = meraki
index=meraki

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi

It event-braking configuration should be in props.conf.

Can you please create props.conf and configure It?

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false

Please refer below link for more information.

https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Propsconf

0 Karma

damode
Motivator

Hi Kamlesh,

Thanks for your input.

But the instructions from the "details" page of the TA-Meraki app mention that those stanza have to be in inputs.conf. link text

Also, why do we need two stanza if they are both literally the same ?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI damode,

Yes, That's true both are same. I have checked the documentation and you are right.

If we add SHOULD_LINEMERGE under [meraki] stanza after TRANSFORMS-meraki_date_clipper in props.conf instead of inputs.conf ???

[meraki]
.
TRANSFORMS-meraki_date_clipper = meraki_date_clipper
SHOULD_LINEMERGE=false
.
.
.

and It resolved our issue then we can contact the developer of this TA.

Thanks

0 Karma

myron_davis
Path Finder

I apologize for those docs.

I modified the README:
https://github.com/AlaskaSSO/TA-meraki/commit/4bf185dec157e85f0c2facc7b7c6746c26891c3c

At some point in the past I used SHOULD_LINEMERGE=false. I don't even know at this point the case that required it.

damode
Motivator

Thanks, Myron.

As per @kamlesh_vaghela comment, do those stanza have to go in props.conf ?
Also, why do we have two stanzas if they are both same,

[monitor:///logpartition/2017/meraki/]
 SHOULD_LINEMERGE=false

 [monitor:///logpartition/2017/meraki/]
 SHOULD_LINEMERGE=false

Can you please update the "details" page of the app as well ?

thanks!

0 Karma

myron_davis
Path Finder

Sorry about the long delay. I updated the details section of the app.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...