- Find Answers
- :
- Splunk Administration
- :
- Deployment Architecture
- :
- Forwarder Management Issue
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi all
I am getting this message on Splunk 6.2.0 after upgrading from 5:
The forwarder management interface does not support some settings in your serverclass.conf file. The interface is now read-only.
One of the offending lines (from the search): WARN DS_DC_Common - Attribute unsupported by UI: stanza=serverClass:windows property=filterType reason='unsupported at this level' The stanza looks OK in the conf file.
The screen is now in read-only mode, can anyone help me with this? Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
filterType is not supported by Forwarder Management at any level. You must remove all filterType attributes from serverclass.conf
if you want to use Forwarder Management.
Here is a List of incompatibilities between the old serverclass.conf and what is supported by Forwarder Management.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
filterType is not supported by Forwarder Management at any level. You must remove all filterType attributes from serverclass.conf
if you want to use Forwarder Management.
Here is a List of incompatibilities between the old serverclass.conf and what is supported by Forwarder Management.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Found it. Instead of finding it in my deploymentclient app's serverclass.conf, I found the filterType directives in my $SPLUNK_HOME/etc/system/local/serverclass.conf. They are commented and the errors are gone.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks for the answer. I don't have it specified anywhere that I know of. But I'll do a thorough check.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I'm also getting this error message. The filterType directive is not declared at the global or app level at all. Thinking that I have to declare it in each stanza?
Enterprise Security Content Update (ESCU) | New Releases
Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?
Index This | What are the 12 Days of Splunk-mas?
