Splunk App for Windows Infrastructure: After upgrading to Splunk 6.3.3, why am I getting "Your indexes and inputs configurations are not internally consistent"?

[swasserroth]

Hi,

After upgrading to Splunk 6.3.3, the following problem is displayed when starting Splunk:

Checking conf files for problems...
            Invalid key in stanza [ui] in /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/app.conf, line 15: attribution_link  (value:  app.attributions).
            Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'

Does anybody know how to solve the problem?
Thanks!

[swasserroth · Accepted solution]

See last comment of jwelch_splunk: Issue has been confirmed, warning should be ignored
This closes the issue -- Thank you!

[jwelch_splunk]

When splunk starts.... It compares the app.conf file against app.conf.spec files. It would seem that you have a key under the [UI] stanza in the app.conf that is not listed as a valid key under the [UI] stanza in the app.conf.spec file.

So from /opt/splunk/etc/

find . -name app.conf.spec |xargs grep app.attributions OR however you would do this in windows.....

If you don't see that Key in any app.conf.spec file then you will get this error upon startup.

I am looking into this to see what I can find out. I will post back when I understand which bit was missed, but from the initial look it seems we are missing a part of the app.conf.spec file. I will file a bug and let you know the outcome.

[jwelch_splunk]

This issue has been confirmed, the warnings are expected and we will document this as a known issue. The app.conf.spec is scheduled to be addressed in a future release.

You can safely ignore the warning at present.

[mattspierce]

I am also getting this error. In my case both the app for nix and app for windows are generating it.

Invalid key in stanza [ui] in /opt/splunk/etc/apps/splunk_app_for_nix/default/app.conf, line 18: attribution_link (value: app.attributions).
Invalid key in stanza [ui] in /opt/splunk/etc/apps/splunk_app_windows_infrastructure/default/app.conf, line 15: attribution_link (value: app.attributions).

[srunyon]

Same issue.

[AlbintEIG]

Same issue here.

[dlpco]

Did you get an answer offline about this. I have the same issue.

[swasserroth]

no answer yet 😞
problem still exists.