With the PagerDuty App for Splunk 1.0 installed on Splunk 6.4 I see this on Splunk start:
Checking conf files for problems... Invalid key in stanza [pagerduty] in /opt/splunk/etc/apps/pagerduty_incidents/local/alert_actions.conf, line 3: param.integration_url (value: ). Invalid key in stanza [pagerduty] in /opt/splunk/etc/apps/pagerduty_incidents/default/alert_actions.conf, line 9: param.incidents_url (value: ). Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug' Done
When running btool it prints:
Checking: /opt/splunk/etc/apps/pagerduty_incidents/local/alert_actions.conf Invalid key in stanza [pagerduty] in /opt/splunk/etc/apps/pagerduty_incidents/local/alert_actions.conf, line 3: param.integration_url (value: ). Did you mean 'param.incident_url'? Did you mean 'payload_format'?
In '$SPLUNK_BASE/etc/apps/pagerduty_incidents/local/alert_actions.conf' file -
changing key name from 'param.integration_url' to 'param.incidents_url' (as mentioned in $SPLUNK_BASE/etc/apps/pagerduty_incidents/README/alert_actions.conf.spec) fixed issue.
# File name: $SPLUNK_BASE/etc/apps/pagerduty_incidents/local/alert_actions.conf [pagerduty] disabled = 0 param.incident_url = https://events.pagerduty.com/integration/<integration_code>/enqueue
I believe this is something the app developer has to fix in the upcoming release.
Take a look here: http://docs.splunk.com/Documentation/Splunk/6.5.3/AdvancedDev/CustomAlertConfig it describes that you need to have a alert_actions.conf file and an alert_actions.conf.spec file
Means take look on the file which is raising the error. Create in the apps README folder the *.spec file with the specification for the values.