Deployment Architecture

How to troubleshoot serverclass.conf error "Attribute unsupported by UI: stanza=serverClass:PerfmonManage...reason='2+ distinct values at this level'"?

bpitts2
Path Finder

Hello all,

This morning I logged into our deployment server and found a message that the forwarder manager screen was in 'read only' mode because some of our serverclass.conf settings were not supported.

Ok, not a big deal, right? I figured I would just browse the config, find the error and correct it.

The error message that was thrown is below:

11-16-2015 12:08:18.789 -0500 WARN  DS_DC_Common - Attribute unsupported by UI: stanza=serverClass:PerfmonManage property=restartSplunkd reason='2+ distinct values at this level'

Well, the problem is that my D:\Program Files\Splunk\etc\system\local\serverclass.conf doesn't contain any stanza named "serverClass:PerfmonManage"

Is there an easy way to figure out where Splunk has picked up "serverClass:PerfmonManage", maybe in another conf that I'm not thinking of?

Thanks,
BPitts2

0 Karma
1 Solution

dgrubb_splunk
Splunk Employee
Splunk Employee

Use btool to see the config...

./splunk cmd btool serverclass list --debug

then track down the serverclass in question with the merged btool output.

View solution in original post

dgrubb_splunk
Splunk Employee
Splunk Employee

Use btool to see the config...

./splunk cmd btool serverclass list --debug

then track down the serverclass in question with the merged btool output.

bpitts2
Path Finder

Ah, btool, I thought that might be the right direction. I'll take a look. Thanks!

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...