Are you a member of the Splunk Community?
- Find Answers
- :
- Splunk Administration
- :
- Getting Data In
- :
- Creating an HTTP Event Collector input generates "...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Creating an HTTP Event Collector input generates "invalid key in stanza" error when running btool on the description field
Add a token for HTTP requeste and run btool:
splunk btool check --debug
You'll get this error:
Checking: /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf
Invalid key in stanza [http://splunk_machine_du_output] in /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf, line 8: description (value: xyz).
Did you mean 'disabled'?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
description is not a valid field for inputs.conf
Have a look at this: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf for available keys.
Try removing it and running btool again
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
description is valid for a token stanza of HTTP Event Collector. It looks like the issue is that inputs.conf.spec is missing the entry. I'll get this fixed.
Your stanza looks correct and should work fine. For example here is a stanza on my box that properly displays the description in the UI.
Sorry for the confusion.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Just checked and we already fixed this in the next version and it is also fixed now in Splunk Cloud.
Here is the entry in inputs.conf.spec
description =
* Human-readable description of this token.
* Defaults to empty string.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Right. The problem is the web UI sticks the description in there.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have replicated your issue. You are correct the UI does add the description to the inputs.conf, and then btool throws an invalid key warning.
Definitely something for Splunk to take a look at in a future release, but it shouldn't have any impact on your server other than the warning message
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I can recreate this if I create an input as well and use characters such as á (or ä, ß). I'm guessing you have such characters in your description because "splunk_machine_du_output" sounds french to me.
This isn't exactly a problem though, splunk should work fine regardless.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You don't reckon she means the command du ?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Ah. Yeah, that makes sense... not my strongest moment apparently.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Yes du refers to the *nix du command.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
As jeffland says make sure ther are no special characters in the description field
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
It's xyz. Nothing special.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
false errors, is never NOT a problem 🙂
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Right - let me rephrase that: this is an annoyance and you could call it a bug, but it should not interfere with splunk operating properly.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What does the stanza [http://splunk_machine_du_output] look like?
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
[http://splunk_machine_du_output]
disabled = 0 index = disk_space_index
indexes = disk_space_index source =
splunk_box sourcetype = our_sourcetype
token =
20202020-4242-4343-4343-434334343434
description = xyz
Tech Talk Recap | Mastering Threat Hunting
Observability for AI Applications: Troubleshooting Latency
Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?
