Invalid key within a stanza?

[jaburke1]

Is there a way to get a list of valid keys for a stanza?

For example: If you get "Invalid key in stanza" for something like:

[file_integrity]
exclude = /file/path

It doesn't like the "exclude" but is there an alternative "key" value to accomplish the same? Thanks in advance!

[richgalloway · Accepted solution]

Valid keys are documented in the related .spec file in $SPLUNK_HOME/etc/system/README.  For instance, for the keys for props.conf see $SPLUNK_HOME/etc/system/README/props.conf.spec.

You also can find the information in the Admin Manual.

[PickleRick]

One caveat - there are occasionally situations (especially with newly introduced features) that the .spec file does not contain proper entry. It doesn't happen often but it does happen sometimes.

[jaburke1]

Thank you @PickleRick 

[jaburke1]

Thank you very much @richgalloway !

[richgalloway]

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.