Master bundle deployment - technology add-ons

[Alteek]

Hello,

I'm currently installing the VMWare application and when I try to deploy the different technologies Add-ons through the master node (master-apps/Splunk_TA_vmware) I receive the following error:

cs-v-splunk-masterchampaero: Invalid
key in stanza [ta_vmware_collection_worker://alpha] in /opt/splunk/etc/master-apps/Splunk_TA_vmware/default/inputs.conf, line 3: capabilities (value: hostvmperf,otherperf,hierarchyinv,hostinv,vminv,clusterinv,datastoreinv,rpinv,task,event)
cs-v-splunk-masterchampaero: Invalid key in stanza [ta_vmware_collection_worker://alpha] in /opt/splunk/etc/master-apps/Splunk_TA_vmware/default/inputs.conf, line 4: log_level (value: INFO)

...

Please find the inputs.conf stanza below:

[ta_vmware_collection_worker://alpha]
capabilities = hostvmperf,otherperf,hierarchyinv,hostinv,vminv,clusterinv,datastoreinv,rpinv,task,event
log_level = INFO
index = vmware
disabled = 1
interval = 15

I have many errors like this one.

Do you have an idea ?

thank you,
Regards

[snowmizer]

Thanks dwaddle. I did have the spec file in the $SPLUNK_HOME/etc/master-apps/Splunk_TA_vmware/README and the references were in the inputs.conf.spec file. It appears that there is an issue when the app doesn't reside in the $SPLUNK_HOME/etc/apps folder. I installed the app on the indexers manually instead of via the cluster master and everything works fine.

[snowmizer]

After further testing putting the apps in $SPLUNK_HOME/etc/apps allowed me to also put them in $SPLUNK_HOME/etc/master-apps and deploy to my indexers from my cluster master. So it appears that validation is happening when the apps reside in $SPLUNK_HOME/etc/apps but Splunk doesn't look for spec files in $SPLUNK_HOME/etc/master-apps when the app has been place here.

Thanks dwaddle!!!

[mikaelbje]

Tested in 6.3.0. Seeing the same there because the app resides in etc/master-apps and not etc/apps. Bug fix?

[dwaddle]

The way this is supposed to work is a modular inputs feature. When an app ships a modular input -- and ta_vmware_collection_worker:// is definitely a modular input -- it is also supposed to ship within the app a README/inputs.conf.spec that specifies all of the inputs.conf options that are available for that modular input. Unlike most applications, in this case the README files are NOT AT ALL OPTIONAL but rather are used to help define what is acceptable in .conf files.

Splunk's various configuration checking tools are supposed to use these to validate configuration files are "good". It sounds like at first glance that you don't have the spec file in the README dir, or possibly you're running into a bug in Splunk.

If you don't have a $SPLUNK_HOME/etc/master_apps/Splunk_TA_vmware/README/inputs.conf.spec file then try putting the right one there from the VMWare app distribution. If this file does exist AND it contains a reference to log_level then it's possible you're hitting upon a bug. I would TRY (no guarantees it'll work) installing Splunk_TA_vmware into the cluster master's etc/apps and see if that makes it able to properly validate configuration on the master-apps.

Please report back what you find.

[snowmizer]

Alteek did you get this resolved? I'm running into the same issue.