All Apps and Add-ons

Why am I seeing this error? Failed to find a valid configuration for multikv stanza = 'tsv_cloudwatch'

Splunk Employee
Splunk Employee

If I click through the Data Summary box and select sourcetype = cloudwatch, I receive the following error message from my indexers:

Failed to find a valid configuration for multikv stanza = 'tsv_cloudwatch'

1 Solution

Splunk Employee
Splunk Employee

The problem here is because the multikv.conf file that is located in the Splunk_TA_aws does not exist on the indexer. In this case, it was only installed on the search head.
To remove the error, either install the Splunk_TA_aws on the indexer or copy the multikv.conf file located in etc/apps/Splunk_TA_aws/default from the search head to the indexer and then restart the splunk service.

View solution in original post

Splunk Employee
Splunk Employee

The problem here is because the multikv.conf file that is located in the Splunk_TA_aws does not exist on the indexer. In this case, it was only installed on the search head.
To remove the error, either install the Splunk_TA_aws on the indexer or copy the multikv.conf file located in etc/apps/Splunk_TA_aws/default from the search head to the indexer and then restart the splunk service.

View solution in original post