Creating an HTTP Event Collector input generates "invalid key in stanza" error when running btool on the description field

[NaraSplunk]

Add a token for HTTP requeste and run btool:
splunk btool check --debug

You'll get this error:

Checking: /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf
        Invalid key in stanza [http://splunk_machine_du_output] in /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf, line 8: description  (value:  xyz).
    Did you mean 'disabled'?

[jplumsdaine22]

description is not a valid field for inputs.conf

Have a look at this: http://docs.splunk.com/Documentation/Splunk/latest/Admin/Inputsconf for available keys.

Try removing it and running btool again

[gblock_splunk]

description is valid for a token stanza of HTTP Event Collector. It looks like the issue is that inputs.conf.spec is missing the entry. I'll get this fixed.

Your stanza looks correct and should work fine. For example here is a stanza on my box that properly displays the description in the UI.

Sorry for the confusion.

[gblock_splunk]

Just checked and we already fixed this in the next version and it is also fixed now in Splunk Cloud.

Here is the entry in inputs.conf.spec

description =
* Human-readable description of this token.
* Defaults to empty string.

[dougmartin]

Right. The problem is the web UI sticks the description in there.

[jplumsdaine22]

I have replicated your issue. You are correct the UI does add the description to the inputs.conf, and then btool throws an invalid key warning.

Definitely something for Splunk to take a look at in a future release, but it shouldn't have any impact on your server other than the warning message

[jeffland]

I can recreate this if I create an input as well and use characters such as á (or ä, ß). I'm guessing you have such characters in your description because "splunk_machine_du_output" sounds french to me.

This isn't exactly a problem though, splunk should work fine regardless.

[jplumsdaine22]

You don't reckon she means the command du ?

[jeffland]

Ah. Yeah, that makes sense... not my strongest moment apparently.

[dougmartin]

Yes du refers to the *nix du command.

[jplumsdaine22]

As jeffland says make sure ther are no special characters in the description field

[dougmartin]

It's xyz. Nothing special.

[dougmartin]

false errors, is never NOT a problem 🙂

[jeffland]

Right - let me rephrase that: this is an annoyance and you could call it a bug, but it should not interfere with splunk operating properly.

[jplumsdaine22]

What does the stanza [http://splunk_machine_du_output] look like?

[dougmartin]

[http://splunk_machine_du_output]
disabled = 0 index = disk_space_index
indexes = disk_space_index source =
splunk_box sourcetype = our_sourcetype
token =
20202020-4242-4343-4343-434334343434
description = xyz