All Apps and Add-ons

Sideview_utils/Splunk on Splunk Error

wildbill4
Path Finder

After installing the Sideview_utils and Splunk on Splunk apps getting the following:

Possible typo in stanza [default] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 2: request.ui_context =
Possible typo in stanza [default] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 3: request.ui_edit_view =
Possible typo in stanza [test_saved_search_with_serialized_context_positive] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 11: request.ui_context = group1=per_index_thruput&group2=per_host_thruput&group3=per_sourcetype_thruput&group3=per_source_thruput&group4=per_index_thruput&group5=per_host_thruput&group6=per_sourcetype_thruput&group6=per_source_thruput&group7=per_index_thruput&group8=per_host_thruput&group9=per_sourcetype_thruput&group9=per_source_thruput
Possible typo in stanza [test_saved_search_with_serialized_context_negative] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 21: request.ui_context = group1=per_source_thruput&group2=per_source_thruput&group3=per_source_thruput&group3=per_host_thruput&group4=per_host_thruput&group5=per_source_thruput&group6=per_source_thruput&group6=per_index_thruput&group7=per_source_thruput&group8=per_sourcetype_thruput&group9=per_index_thruput&group9=per_host_thruput
Possible typo in stanza [test_saved_search_for_back_button_cases] in /opt/splunk/etc/apps/sideview_utils/default/savedsearches.conf, line 29: request.ui_context = textfield1=baz3&autoRun=True&pulldown1=foo3&pulldown2=bar3&checkbox=true
There might be typos in your conf files.

Any help would be greatly appreciated.

1 Solution

dwaddle
SplunkTrust
SplunkTrust

The "possible typos" related to Sideview utils can be safely ignored. Splunk has a "schema" file for each config file telling it what it should expect as far as stanza/key names, and some of Sideview Util's configuration objects are not in that schema.

View solution in original post

hexx
Splunk Employee
Splunk Employee

This error message will go away in the next version of SoS.

0 Karma

dwaddle
SplunkTrust
SplunkTrust

The "possible typos" related to Sideview utils can be safely ignored. Splunk has a "schema" file for each config file telling it what it should expect as far as stanza/key names, and some of Sideview Util's configuration objects are not in that schema.

sideview
SplunkTrust
SplunkTrust

Splunk provided a mechanism to extend the schema, and Utils follows that mechanism, but some older versions of Splunk still gave the warning regardless. I think on 4.3 and 5.0 these warnings don't happen anymore because Splunk sees the declarations in the readme dir and thus recognizes the stanzas as intentional config rather than typos.

0 Karma

wildbill4
Path Finder

Thanks for the info

0 Karma

wildbill4
Path Finder

Also seeing the following when I open the SOS App:

Misconfigured view 'inputs' - Unknown parameter 'level' is defined for module Message. Make sure the parameter is specified in Message.conf.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...