With the PagerDuty App for Splunk 1.0 installed on Splunk 6.4 I see this on Splunk start:
Checking conf files for problems... Invalid key in stanza [pagerduty] in /opt/splunk/etc/apps/pagerduty_incidents/local/alert_actions.conf, line 3: param.integration_url (value: ). Invalid key in stanza [pagerduty] in /opt/splunk/etc/apps/pagerduty_incidents/default/alert_actions.conf, line 9: param.incidents_url (value: ). Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug' Done
When running btool it prints:
Checking: /opt/splunk/etc/apps/pagerduty_incidents/local/alert_actions.conf Invalid key in stanza [pagerduty] in /opt/splunk/etc/apps/pagerduty_incidents/local/alert_actions.conf, line 3: param.integration_url (value: ). Did you mean 'param.incident_url'? Did you mean 'payload_format'?
did you create a alert_actions.conf.spec file in the README folder?
[pagerduty] param.integration_url=<string> param.incidents_url=<string>
I am having this same issue. What are you referring to thomas?
Take a look here: http://docs.splunk.com/Documentation/Splunk/6.5.3/AdvancedDev/CustomAlertConfig it describes that you need to have a alertactions.conf file and an alertactions.conf.spec file
Means take look on the file which is raising the error. Create in the apps README folder the *.spec file with the specification for the values.
I will create both of those files and give it a shot. It seems like the app would handle all of this setup by default. Am i missing something?
In '$SPLUNKBASE/etc/apps/pagerdutyincidents/local/alert_actions.conf' file -
changing key name from 'param.integration_url' to 'param.incidents_url' (as mentioned in $SPLUNKBASE/etc/apps/pagerdutyincidents/README/alert_actions.conf.spec) fixed issue.
# File name: $SPLUNK_BASE/etc/apps/pagerduty_incidents/local/alert_actions.conf [pagerduty] disabled = 0 param.incident_url = https://events.pagerduty.com/integration/<integration_code>/enqueue
I believe this is something the app developer has to fix in the upcoming release.