All Apps and Add-ons

Master bundle deployment - technology add-ons

Alteek
Explorer

Hello,

I'm currently installing the VMWare application and when I try to deploy the different technologies Add-ons through the master node (master-apps/Splunk_TA_vmware) I receive the following error:

cs-v-splunk-masterchampaero: Invalid
key in stanza [ta_vmware_collection_worker://alpha] in /opt/splunk/etc/master-apps/Splunk_TA_vmware/default/inputs.conf, line 3: capabilities (value: hostvmperf,otherperf,hierarchyinv,hostinv,vminv,clusterinv,datastoreinv,rpinv,task,event)
cs-v-splunk-masterchampaero: Invalid key in stanza [ta_vmware_collection_worker://alpha] in /opt/splunk/etc/master-apps/Splunk_TA_vmware/default/inputs.conf, line 4: log_level (value: INFO)

...

Please find the inputs.conf stanza below:

[ta_vmware_collection_worker://alpha]
capabilities = hostvmperf,otherperf,hierarchyinv,hostinv,vminv,clusterinv,datastoreinv,rpinv,task,event
log_level = INFO
index = vmware
disabled = 1
interval = 15

I have many errors like this one.

Do you have an idea ?

thank you,
Regards

snowmizer
SplunkTrust
SplunkTrust

Thanks dwaddle. I did have the spec file in the $SPLUNK_HOME/etc/master-apps/Splunk_TA_vmware/README and the references were in the inputs.conf.spec file. It appears that there is an issue when the app doesn't reside in the $SPLUNK_HOME/etc/apps folder. I installed the app on the indexers manually instead of via the cluster master and everything works fine.

0 Karma

snowmizer
SplunkTrust
SplunkTrust

After further testing putting the apps in $SPLUNK_HOME/etc/apps allowed me to also put them in $SPLUNK_HOME/etc/master-apps and deploy to my indexers from my cluster master. So it appears that validation is happening when the apps reside in $SPLUNK_HOME/etc/apps but Splunk doesn't look for spec files in $SPLUNK_HOME/etc/master-apps when the app has been place here.

Thanks dwaddle!!!

0 Karma

mikaelbje
Motivator

Tested in 6.3.0. Seeing the same there because the app resides in etc/master-apps and not etc/apps. Bug fix?

0 Karma

dwaddle
SplunkTrust
SplunkTrust

The way this is supposed to work is a modular inputs feature. When an app ships a modular input -- and ta_vmware_collection_worker:// is definitely a modular input -- it is also supposed to ship within the app a README/inputs.conf.spec that specifies all of the inputs.conf options that are available for that modular input. Unlike most applications, in this case the README files are NOT AT ALL OPTIONAL but rather are used to help define what is acceptable in .conf files.

Splunk's various configuration checking tools are supposed to use these to validate configuration files are "good". It sounds like at first glance that you don't have the spec file in the README dir, or possibly you're running into a bug in Splunk.

If you don't have a $SPLUNK_HOME/etc/master_apps/Splunk_TA_vmware/README/inputs.conf.spec file then try putting the right one there from the VMWare app distribution. If this file does exist AND it contains a reference to log_level then it's possible you're hitting upon a bug. I would TRY (no guarantees it'll work) installing Splunk_TA_vmware into the cluster master's etc/apps and see if that makes it able to properly validate configuration on the master-apps.

Please report back what you find.

snowmizer
SplunkTrust
SplunkTrust

Alteek did you get this resolved? I'm running into the same issue.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...