- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Is there a way to get a list of valid keys for a stanza?
For example: If you get "Invalid key in stanza" for something like:
[file_integrity]
exclude = /file/path
It doesn't like the "exclude" but is there an alternative "key" value to accomplish the same? Thanks in advance!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Valid keys are documented in the related .spec file in $SPLUNK_HOME/etc/system/README. For instance, for the keys for props.conf see $SPLUNK_HOME/etc/system/README/props.conf.spec.
You also can find the information in the Admin Manual.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


Valid keys are documented in the related .spec file in $SPLUNK_HOME/etc/system/README. For instance, for the keys for props.conf see $SPLUNK_HOME/etc/system/README/props.conf.spec.
You also can find the information in the Admin Manual.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content

One caveat - there are occasionally situations (especially with newly introduced features) that the .spec file does not contain proper entry. It doesn't happen often but it does happen sometimes.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you @PickleRick
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you very much @richgalloway !
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content


If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
If this reply helps you, Karma would be appreciated.
