All Apps and Add-ons

Invalid key in stanza "SHOULD_LINEMERGE" of inputs.conf. How to resolve ?

damode
Motivator

getting this error When Splunk runs the process, "checking conf files for problems..." during restart,

Checking: C:\program> files\splunk\etc\apps\TA-meraki\local\inputs.conf
Invalid key in stanza [monitor:///logpartition/2017/meraki/] in C:\program files\splunk\etc\apps\TA-meraki\local\inputs.conf, line 10: SHOULD_LINEMERGE (value:false).
Did you mean 'source'?
Did you mean 'sourcetype'?

Below is what my inputs.conf looks like

[udp://1514]
connection_host = dns
index = meraki
sourcetype = meraki
disabled = 0

[default]
host_segment = 4

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
sourcetype = meraki
index=meraki

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false
sourcetype = meraki
index=meraki

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Hi

It event-braking configuration should be in props.conf.

Can you please create props.conf and configure It?

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false

[monitor:///logpartition/2017/meraki/]
SHOULD_LINEMERGE=false

Please refer below link for more information.

https://docs.splunk.com/Documentation/Splunk/7.0.0/Admin/Propsconf

0 Karma

damode
Motivator

Hi Kamlesh,

Thanks for your input.

But the instructions from the "details" page of the TA-Meraki app mention that those stanza have to be in inputs.conf. link text

Also, why do we need two stanza if they are both literally the same ?

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

HI damode,

Yes, That's true both are same. I have checked the documentation and you are right.

If we add SHOULD_LINEMERGE under [meraki] stanza after TRANSFORMS-meraki_date_clipper in props.conf instead of inputs.conf ???

[meraki]
.
TRANSFORMS-meraki_date_clipper = meraki_date_clipper
SHOULD_LINEMERGE=false
.
.
.

and It resolved our issue then we can contact the developer of this TA.

Thanks

0 Karma

myron_davis
Path Finder

I apologize for those docs.

I modified the README:
https://github.com/AlaskaSSO/TA-meraki/commit/4bf185dec157e85f0c2facc7b7c6746c26891c3c

At some point in the past I used SHOULD_LINEMERGE=false. I don't even know at this point the case that required it.

damode
Motivator

Thanks, Myron.

As per @kamlesh_vaghela comment, do those stanza have to go in props.conf ?
Also, why do we have two stanzas if they are both same,

[monitor:///logpartition/2017/meraki/]
 SHOULD_LINEMERGE=false

 [monitor:///logpartition/2017/meraki/]
 SHOULD_LINEMERGE=false

Can you please update the "details" page of the app as well ?

thanks!

0 Karma

myron_davis
Path Finder

Sorry about the long delay. I updated the details section of the app.

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...