All Apps and Add-ons

Why am I getting "Invalid key in stanza" errors trying to configure the Splunk Add-on for Microsoft Cloud Services?

a212830
Champion

Hi,

I'm following the doc for configuring Splunk Add-on for Microsoft Cloud Services (http://docs.splunk.com/Documentation/AddOns/released/MSCloudServices/Configureaccount ), and using config files, but keep getting an "invalid stanza key in stanza" error.

 Checking conf files for problems...
                Invalid key in stanza [TESTSVB] in /apps/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/local/splunk_ta_ms_o365_server_settings.conf, line 2: client_id (value: "123456").
                Invalid key in stanza [TESTSVB] in /apps/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/local/splunk_ta_ms_o365_server_settings.conf, line 3: client_secret (value: "123456").
                Invalid key in stanza [TESTSVB] in /apps/splunk/etc/apps/Splunk_TA_microsoft-cloudservices/local/splunk_ta_ms_o365_server_settings.conf, line 4: tenant_id (value: "123456").

I don't see any issues with these values. Anyone run into this?

[TESTSVB]
client_id="123456"
client_secret="123456"
tenant_id="123456"

[logging]
agent = DEBUG
server = DEBUG
disabled = 0

[proxy]
proxy_enabled = 1
proxy_port = 8000
proxy_rdns = 1
proxy_type = http
proxy_url = https.proxy.fmr.com
disabled = 0
0 Karma
1 Solution

Masa
Splunk Employee
Splunk Employee

Probably you are supposed to edit * splunk_ta_ms_o365_server_accounts.conf*, not splunk_ta_ms_o365_server_settings.conf

View solution in original post

Masa
Splunk Employee
Splunk Employee

Probably you are supposed to edit * splunk_ta_ms_o365_server_accounts.conf*, not splunk_ta_ms_o365_server_settings.conf

sloshburch
Splunk Employee
Splunk Employee

@a212830 and I talked on the side and I think this is the same conclusion we had. @a212830 - tis true? Accept this answer?

0 Karma

Masa
Splunk Employee
Splunk Employee

@SloshBurch, Thank you for the follow-up.

More information about the warning message,
splunk btool check --debug compares configurations with its spec file.

For a custom app's custom conf files, developer needs to provide spec file in etc/apps/$app_name$/README directory. If spec file is missing proper attributes or stanza or configurations(attributes or stanzas) do not match with attributes or stanza in the spec file, warning message will be generated like this case.

0 Karma

sloshburch
Splunk Employee
Splunk Employee

@masa - thanks for elaborating for posterity!

@a212830 - I noticed you haven't accepted the answer and usually you do that so just wanted to check: all set with this question or something outstanding?

a212830
Champion

This particular problem is fixed, but still not seeing data. Investigating.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...