Archive

Possible typo in stanza after upgrading to 4.2

Path Finder

Hi all,

I am not the first one complaining about it. As I read v4.2 of Splunk checks the keys in stanzas and reports "possible typo". Which logicaly leads the user to "Oops. I made a typo.". But when you think - but that was OK in 4.1 (no messages about it) so they must have changed something in the key(s) or the keys are obsolete now. For example i discovered many of my apps had mistakenly "enabledOnClient" instead of "stateOnClient". How do I know the latter is correct - because I asked someone and he told me that after digging in some files he found it. I found it later in serverclass.conf.spec. But... THERE IS NOT A WORD ABOUT enabledOnCilent BEING OBSOLETE. IT IS JUST GONE. So how the hell should I know what is obsolete, which keys have changed and what is really a typo??? I find this approach from Splunk a mess. You should at least mention obsolete or typo. And if the check of the conf files is introduced first now and it also finds obsolete keys from much earlier versions then the check should also tell with what was this key replaced as you cannot expect users to search through release notes of 10 versions back where was that key obsolete and how was it replaced....

"splunk btool check --debug"... Yeah. Don't joke. It suggest 3 or 5 keys the description of which I should now study and guess which one is now valid... Beautifull...

My question: is there a full list of obsolete keys up to version 4.2 including their valid replacements???

My splunk is complaining about: inputs.conf : connection_host=dns web.conf : compressStaticFiles=true web.conf : userEntTrialRegistrationURL=... web.conf : userResendRegistrationURL

1 Solution

Splunk Employee
Splunk Employee

The typo for the "connection_host" configuration parameter in [udp://] stanzas of inputs.conf is indeed misreported and we currently have a bug opened to fix this problem (SPL-38051).

For more details, see this Splunk Answer.

View solution in original post

Contributor

While it may be checking now when it didn't before, I think it's catching 'bugs' because it seems to be pointing to previously un-edited 'default' files. I'm guessing 4.2.1 is coming soon...;-)

I ran:

/opt/splunk/bin/splunk btool check --debug

and looked at the output, looking for the phrases "Possible typo..." In one instance, it actually suggested a fix:

Possible typo in stanza [DefaultTargetDC] in /opt/splunk/etc/apps/windows/default/admon.conf, line 14: targetDc = Did you mean 'targetDC'?

So, I manually edited the admon.conf file (yes, the one in default; gasp!) and corrected the lower-case 'd' to 'D' in 'DC'. Error went away. Now, I'll be golden if I can figure out (and how to fix) these:

Possible typo in stanza [Defrag_Events] in /opt/splunk/etc/apps/windows/default/eventtypes.conf, line 342: query = source=registry *dfrgntfs.exe path=Dfrg

Possible typo in stanza [Windows_Updates] in /opt/splunk/etc/apps/windows/default/eventtypes.conf, line 346: query = source=registry process_image=*wuauclt.exe wuauclt

0 Karma

Splunk Employee
Splunk Employee

you probably need to update the windows app. Also, look into the corresponding spec files in $SPLUNK_HOME/etc/system/README/

0 Karma

Splunk Employee
Splunk Employee

The typo for the "connection_host" configuration parameter in [udp://] stanzas of inputs.conf is indeed misreported and we currently have a bug opened to fix this problem (SPL-38051).

For more details, see this Splunk Answer.

View solution in original post

Splunk Employee
Splunk Employee

http://answers.splunk.com/questions/12576/why-is-splunk-reporting-possible-typos-in-configuration-fi...

The behavior you are observing is a result of Splunk 4.2 checking the keys and values in live configuration files by comparing them with the contents of the spec file for that configuration file. This did not happen under 4.1, but that does not mean there wasn't a configuration error in your conf files. There is not a full list of obsolete or deprecated settings in one specific place, afaik.

The error does not cause Splunk to stop functioning in any way, it is just warning you about possible configuration errors that may exist, providing an opportunity for you to investigate and correct, if necessary, any errors that may exist.