Getting Data In

Where is the invalid key in my inputs.conf?

cburgman
Path Finder

Receiving:
Invalid key in stanza [monitor://D:\\radiantone\\vds\\vds_server\\logs] in , line 6: whitelist1 (value: vds_server.*\.log).
Invalid key in stanza [monitor://D:\\radiantone\\vds\\vds_server\\logs] in <c:\Program Files\SplunkUniversalForwarder\etc\apps\bsw_vds_inputs\local\inputs.conf>, line 7: whitelist2 (value: vds_server\.log).

Here is the inputs.conf:

[monitor://D:\\radiantone\\vds\\vds_server\\logs]
index=vds_logs
sourcetype=VDS_define_sourcetype
whitelist=vds_server_\d{4}-\d{2}-\d{2}.*\.log
whitelist1=vds_server.*\.log
whitelist2=vds_server\.log
0 Karma
1 Solution

lacastillo
Path Finder

It looks like you're trying to use the whitelists in inputs.conf as a means of specifying which files to monitor when it's meant to be used as a means of whitelisting specific events within a monitored file. I believe you would just need a separate monitoring stanza for each of your whitelisted values.

Let me know if this helped.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Inputsconf#MONITOR:

View solution in original post

lacastillo
Path Finder

It looks like you're trying to use the whitelists in inputs.conf as a means of specifying which files to monitor when it's meant to be used as a means of whitelisting specific events within a monitored file. I believe you would just need a separate monitoring stanza for each of your whitelisted values.

Let me know if this helped.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Inputsconf#MONITOR:

cburgman
Path Finder

You are correct... I added an additional stanza and now I am seeing logs. Thanks!

0 Karma

lacastillo
Path Finder

You're very welcome!

0 Karma

lacastillo
Path Finder

I don't see mistake yet but here are the docs I'm referencing. Hope this helps.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Inputsconf#Event_Log_whitelist_and_blacklis...

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...