Getting the following error when starting the Splunk service on my DCN:
Checking conf files for problems... Invalid key in stanza [dm_accel_settings://Performance] in /opt/splunk/etc/apps/Splunk_TA_vmware/default/inputs.conf, line 77: acceleration (value: true) Invalid key in stanza [dm_accel_settings://Change_Analysis] in /opt/splunk/etc/apps/Splunk_TA_vmware/default/inputs.conf, line 80: acceleration (value: true) Invalid key in stanza [dm_accel_settings://Authentication] in /opt/splunk/etc/apps/Splunk_TA_vmware/default/inputs.conf, line 83: acceleration (value: true) Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug' Done
Here are the relevant lines in the inputs.conf:
[dm_accel_settings://Performance] acceleration = true [dm_accel_settings://Change_Analysis] acceleration = true [dm_accel_settings://Authentication] acceleration = true
It appears that there is no information in the .spec file for this field which is why it errors. Here is my inputs.conf.spec file:
# Copyright (C) 2005-2014 Splunk Inc. All Rights Reserved. [ta_vmware_collection_worker://<name>] capabilities = <value> * this is the comma delimited list of actions that the worker can perform (hostvmperf, otherperf, etc.) log_level = <value> * the level at which the worker will log data. duration = <value> * the minimum time between runs of the input should it exit for some reason [ta_vmware_collection_scheduler://<name>] * the scheduler should only exist once log_level = <value> * the level at which the scheduler will log data. duration = <value> * the minimum time between runs of the input should it exit for some reason
Since this is in the default inputs.conf file, I can only assume that someone hasn't updated the respective .spec file to also accommodate this property?
As of v3.2, neither SA-Hydra nor SA-Utils are required on the Indexer, yet we still get the 'Invalid key in stanza' errors during
splunk start (as well as from `splunk btool check --debug).
I'm right there with you Bryan... To get past this I searched through all the SA's and TA's looking at the inputs.conf.spec files. I found that the stanza Splunk_TA_vmware was expecting lives in the SA-VMNetAppUtils inputs.conf.spec file (SA-VMNetAppUtils/README/inputs.conf.spec). I copied the necessary stanza from there, made a backup copy of the inputs.conf.spec file in Splunk_TA_vmware, and then pasted the missing stanza into the inputs spec file. From there I ran my cluster bundle apply and saw no errors.
For reference, here is the missing stanza:
* Configure an input for enforcing data model acceleration settings automatically
* when another app is installed. Note that only one app at a time should define
* the acceleration settings for a given data model. Usually this is the "primary"
* app for the suite of apps on the system, e.g. SplunkEnterpriseSecuritySuite.
acceleration = [true|false]
* True if the data model should be accelerated.
manual_rebuilds = [true|false]
* If true, changes to the datamodel will not automatically rebuild the HPAS
* data store.`
Thanks, somehow I overlooked that and the SA-Hydra being installed on the DCN.
For reference here is the appropriate link to the docs that breaks out what needs to be installed and where:
It is kinda weird to me that they put those in the Splunk_TA_vmware App instead of sticking those specific inputs lines inside an inputs file inside of SA-Utils. Because if you mess it up there isn't an intuitive way to identify where you made the mistake.
same idea as multiple props.conf all over apps and addons. You can add only one spec file to make use of the Modular Input scope in other add-ons instead of copying the spec file all over. btool is your friend for configurations.
One thing I agree with is that, there is no easy tool provided by Splunk in order to find a spec file.