All Apps and Add-ons
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
Ask a Question

Splunk_TA_paloalto causing many Invalid Key errors during restart of Splunk (Palo Alto Networks Add on for Splunk, Version 3.8.0 April 28, 2017)

wrangler2x
Motivator
‎07-24-2017 04:14 PM

Is there something that we are supposed to be doing after installing this or is it just broken?

Here is my output during startup of splunkd

Checking conf files for problems...
        Invalid key in stanza [pan_globalprotect.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 8: outputMode  (value:  splunkstream).
        Invalid key in stanza [pan_globalprotect.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 14: autotimestamp  (value:  1).
        Invalid key in stanza [pan_globalprotect.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 15: randomizeCount  (value:  0.2).
        Invalid key in stanza [pan_globalprotect.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 16: randomizeEvents  (value:  0).
        Invalid key in stanza [pan_globalprotect.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 18: sourcetype  (value:  pan:log).
        Invalid key in stanza [pan_globalprotect.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 19: source  (value:  eventgen:pan_globalprotect.samplelog).
        Invalid key in stanza [pan_incident.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 27: outputMode  (value:  splunkstream).
        Invalid key in stanza [pan_incident.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 33: randomizeCount  (value:  0.2).
        Invalid key in stanza [pan_incident.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 34: randomizeEvents  (value:  true).
        Invalid key in stanza [pan_incident.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 36: sourcetype (value: pan:log).
        Invalid key in stanza [pan_incident.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 37: source  (value:  eventgen:pan_incident.samplelog).
        Invalid key in stanza [pan_endpoint.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 68: outputMode  (value:  splunkstream).
        Invalid key in stanza [pan_endpoint.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 74: randomizeCount  (value:  0.2).
        Invalid key in stanza [pan_endpoint.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 75: randomizeEvents  (value:  true).
        Invalid key in stanza [pan_endpoint.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 77: sourcetype (value: pan:log).
        Invalid key in stanza [pan_endpoint.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 78: source  (value:  eventgen:pan_endpoint.samplelog).
        Invalid key in stanza [pan_endpoint.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 79: autotimestamp  (value:  1).
        Invalid key in stanza [pan_incident_data_config.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 88: outputMode  (value:  splunkstream).
        Invalid key in stanza [pan_incident_data_config.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 94: randomizeCount  (value:  0.2).
        Invalid key in stanza [pan_incident_data_config.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 95: randomizeEvents  (value:  true).
        Invalid key in stanza [pan_incident_data_config.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 97: sourcetype  (value:  pan:log).
        Invalid key in stanza [pan_incident_data_config.samplelog] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 98: source  (value:  eventgen:pan_incident_data_config.samplelog).
        Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 119: mode  (value:  replay).
        Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 120: sampletype  (value:  csv).
        Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 121: timeField  (value:  _time).
        Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 122: index  (value:  main).
        Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 128: timeMultiple  (value:  2).
        Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 129: autotimestamp  (value:  1).
        Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 134: sourcetype  (value:  pan:log).
        Invalid key in stanza [pan_wildfire_reports.csv] in /opt/splunk/etc/apps/Splunk_TA_paloalto/default/eventgen.conf, line 135: source  (value:  eventgen:pan_wildfire_reports.csv).
        Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
Done
Reply

mghocke
Path Finder
‎07-25-2017 01:06 PM

It's safe to delete eventgen.conf and the samples directory one level above. It's actually required when you want to install an app on an indexer cluster.

Reply

wrangler2x
Motivator
‎07-25-2017 03:32 PM

That did the trick. Also, I had someone send me this link: http://docs.splunk.com/Documentation/AddOns/released/Overview/Distributedinstall#Indexer_clusters

0 Karma
Reply
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Watch Now!   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to leverage ...

More Control Over Your Monitoring Costs with Archived Metrics!

What if there was a way you could keep all the metrics data you need while saving on storage costs?This is now ...

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...