Trying to apply the Splunk Add-on for Microsoft Hyper-V to an indexer cluster bundle, why are we getting "Not URI Encoded" errors?

[jonesnadiam]

Hi,

We are trying to apply the Splunk Add-on for Microsoft Hyper-V to an indexer cluster bundle. When running the command, we receive the following error:

In handler 'clustermastercontrol': The Master could not push the latest configu
ration bundle because it contains an invalid configuration. Fix any errors and p
ush the bundle again. Alternatively, you can skip the validation process like th
is: "splunk apply cluster-bundle --skip-validation". Use this option carefully,
as it can cause the master to push an invalid configuration to the peers. The fo
llowing errors were encountered:

;               Value in stanza [eventtype=hyperv:inventory] in C:\Program Files
\Splunk\etc\master-apps\avn_dcs_TA_microsoft-hyperv\default\tags.conf, line 3 no
t URI encoded: eventtype = hyperv:inventory
;               Value in stanza [eventtype=hyperv:vm] in C:\Program Files\Splunk
\etc\master-apps\avn_dcs_TA_microsoft-hyperv\default\tags.conf, line 12 not URI
encoded: eventtype = hyperv:vm
;               Value in stanza [eventtype=hyperv:alerts] in C:\Program Files\Sp
lunk\etc\master-apps\avn_dcs_TA_microsoft-hyperv\default\tags.conf, line 17 not
URI encoded: eventtype = hyperv:alerts
;               Value in stanza [eventtype=hyperv:performance] in C:\Program Fil
es\Splunk\etc\master-apps\avn_dcs_TA_microsoft-hyperv\default\tags.conf, line 22
 not URI encoded: eventtype = hyperv:performance
;               Value in stanza [eventtype=hyperv:disk] in C:\Program Files\Splu
nk\etc\master-apps\avn_dcs_TA_microsoft-hyperv\default\tags.conf, line 25 not UR
I encoded: eventtype = hyperv:disk
;               Value in stanza [eventtype=hyperv:network] in C:\Program Files\S
plunk\etc\master-apps\avn_dcs_TA_microsoft-hyperv\default\tags.conf, line 28 not
 URI encoded: eventtype = hyperv:network
;               Value in stanza [eventtype=hyperv:processor] in C:\Program Files
\Splunk\etc\master-apps\avn_dcs_TA_microsoft-hyperv\default\tags.conf, line 31 n
ot URI encoded: eventtype = hyperv:processor
;No spec file for: C:\Program Files\Splunk\etc\master-apps\avn_its_TA_microsoft-
hyperv\default\eventgen.conf
;               Value in stanza [eventtype=hyperv:inventory] in C:\Program Files
\Splunk\etc\master-apps\avn_its_TA_microsoft-hyperv\default\tags.conf, line 3 no
t URI encoded: eventtype = hyperv:inventory
;               Value in stanza [eventtype=hyperv:vm] in C:\Program Files\Splunk
\etc\master-apps\avn_its_TA_microsoft-hyperv\default\tags.conf, line 12 not URI
encoded: eventtype = hyperv:vm
;               Value in stanza [eventtype=hyperv:alerts] in C:\Program Files\Sp
lunk\etc\master-apps\avn_its_TA_microsoft-hyperv\default\tags.conf, line 17 not
URI encoded: eventtype = hyperv:alerts
;               Value in stanza [eventtype=hyperv:performance] in C:\Program Fil
es\Splunk\etc\master-apps\avn_its_TA_microsoft-hyperv\default\tags.conf, line 22
 not URI encoded: eventtype = hyperv:performance
;               Value in stanza [eventtype=hyperv:disk] in C:\Program Files\Splu
nk\etc\master-apps\avn_its_TA_microsoft-hyperv\default\tags.conf, line 25 not UR
I encoded: eventtype = hyperv:disk
;               Value in stanza [eventtype=hyperv:network] in C:\Program Files\S
plunk\etc\master-apps\avn_its_TA_microsoft-hyperv\default\tags.conf, line 28 not
 URI encoded: eventtype = hyperv:network
;               Value in stanza [eventtype=hyperv:processor] in C:\Program Files
\Splunk\etc\master-apps\avn_its_TA_microsoft-hyperv\default\tags.conf, line 31 n
ot URI encoded: eventtype = hyperv:processor

We have confirmed that the configuration files are using UTF-8 encoding. Any ideas what the issue could be?

[kuja]

Check this out:
http://docs.splunk.com/Documentation/AddOns/released/MSHyperV/Distributeddeployment

You really don't need it unless you are using a light forwarder. I would suggest removing this from your indexers.

HTH

[jbailey_splunk]

I'm not familiar with the TA naming convention I see in your logs -> avn_its_TA_microsoft_hyperv. I downloaded the most recent version of the Splunk Add-on for Microsoft Hyper-V and extracted the tarball and observed the naming convention of the TA is: Splunk_TA_Microsoft-hyperv. So I would suggest going to splunkbase and downloading the most recent version available, which would be version 2.0.1, and deploying this version in your environment.

Also, note that you can deploy the add-on from the Cluster Master by running: splunk apply cluster-bundle --skip-validation
This will skip the validation on the Cluster Master and deploy to the indexers.

Hope this helps...