Sideview_utils/Splunk on Splunk Error

[wildbill4]

After installing the Sideview_utils and Splunk on Splunk apps getting the following:

Possible typo in stanza [default] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 2: request.ui_context =
Possible typo in stanza [default] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 3: request.ui_edit_view =
Possible typo in stanza [test_saved_search_with_serialized_context_positive] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 11: request.ui_context = group1=per_index_thruput&group2=per_host_thruput&group3=per_sourcetype_thruput&group3=per_source_thruput&group4=per_index_thruput&group5=per_host_thruput&group6=per_sourcetype_thruput&group6=per_source_thruput&group7=per_index_thruput&group8=per_host_thruput&group9=per_sourcetype_thruput&group9=per_source_thruput
Possible typo in stanza [test_saved_search_with_serialized_context_negative] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 21: request.ui_context = group1=per_source_thruput&group2=per_source_thruput&group3=per_source_thruput&group3=per_host_thruput&group4=per_host_thruput&group5=per_source_thruput&group6=per_source_thruput&group6=per_index_thruput&group7=per_source_thruput&group8=per_sourcetype_thruput&group9=per_index_thruput&group9=per_host_thruput
Possible typo in stanza [test_saved_search_for_back_button_cases] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 29: request.ui_context = textfield1=baz3&autoRun=True&pulldown1=foo3&pulldown2=bar3&checkbox=true
There might be typos in your conf files.

Any help would be greatly appreciated.

[hexx]

This error message will go away in the next version of SoS.

[dwaddle · Accepted solution]

The "possible typos" related to Sideview utils can be safely ignored. Splunk has a "schema" file for each config file telling it what it should expect as far as stanza/key names, and some of Sideview Util's configuration objects are not in that schema.

[sideview]

Splunk provided a mechanism to extend the schema, and Utils follows that mechanism, but some older versions of Splunk still gave the warning regardless. I think on 4.3 and 5.0 these warnings don't happen anymore because Splunk sees the declarations in the readme dir and thus recognizes the stanzas as intentional config rather than typos.

[wildbill4]

Thanks for the info

[wildbill4]

Also seeing the following when I open the SOS App:

Misconfigured view 'inputs' - Unknown parameter 'level' is defined for module Message. Make sure the parameter is specified in Message.conf.