Getting Data In

Splunk 4.2 complains about possible typo for CLEAN_KEYS

joshd
Builder

Upon an upgrade to 4.2 I noticed that splunk spit out the following:

Possible typo in stanza [source::/tmp/test.csv] in /opt/splunk/etc/system/local/props.conf, line 16: CLEAN_KEYS  =  false
        Did you mean 'CHARSET'?
        Did you mean 'CHECK_FOR_HEADER'?
        Did you mean 'CHECK_METHOD'?
        Did you mean 'Conversely, if you commonly search a large event set with expressions like company_id!'?

Did CLEAN_KEYS get phased out of Splunk 4.2? I don't see any mention of it anywhere...

Thanks, Josh

Tags (2)
0 Karma
1 Solution

hazekamp
Builder

CLEAN_KEYS is actually a transforms.conf setting, not props.conf. This is why config checker is barking. It's not actually a typo, but an invalid setting for props.conf. http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf

View solution in original post

hazekamp
Builder

CLEAN_KEYS is actually a transforms.conf setting, not props.conf. This is why config checker is barking. It's not actually a typo, but an invalid setting for props.conf. http://www.splunk.com/base/Documentation/latest/Admin/Transformsconf

joshd
Builder

Ah shoot, you are right, that's my bad. Thanks for pointing out my oversight!

0 Karma
Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...