Getting Data In

Where is the invalid key in my inputs.conf?

cburgman
Path Finder

Receiving:
Invalid key in stanza [monitor://D:\\radiantone\\vds\\vds_server\\logs] in , line 6: whitelist1 (value: vds_server.*\.log).
Invalid key in stanza [monitor://D:\\radiantone\\vds\\vds_server\\logs] in <c:\Program Files\SplunkUniversalForwarder\etc\apps\bsw_vds_inputs\local\inputs.conf>, line 7: whitelist2 (value: vds_server\.log).

Here is the inputs.conf:

[monitor://D:\\radiantone\\vds\\vds_server\\logs]
index=vds_logs
sourcetype=VDS_define_sourcetype
whitelist=vds_server_\d{4}-\d{2}-\d{2}.*\.log
whitelist1=vds_server.*\.log
whitelist2=vds_server\.log
0 Karma
1 Solution

lacastillo
Path Finder

It looks like you're trying to use the whitelists in inputs.conf as a means of specifying which files to monitor when it's meant to be used as a means of whitelisting specific events within a monitored file. I believe you would just need a separate monitoring stanza for each of your whitelisted values.

Let me know if this helped.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Inputsconf#MONITOR:

View solution in original post

lacastillo
Path Finder

It looks like you're trying to use the whitelists in inputs.conf as a means of specifying which files to monitor when it's meant to be used as a means of whitelisting specific events within a monitored file. I believe you would just need a separate monitoring stanza for each of your whitelisted values.

Let me know if this helped.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Inputsconf#MONITOR:

cburgman
Path Finder

You are correct... I added an additional stanza and now I am seeing logs. Thanks!

0 Karma

lacastillo
Path Finder

You're very welcome!

0 Karma

lacastillo
Path Finder

I don't see mistake yet but here are the docs I'm referencing. Hope this helps.

https://docs.splunk.com/Documentation/Splunk/7.1.1/Admin/Inputsconf#Event_Log_whitelist_and_blacklis...

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to November Tech Talks, Office Hours, and Webinars!

&#x1f342; Fall into November with a fresh lineup of Community Office Hours, Tech Talks, and Webinars we’ve ...

Transform your security operations with Splunk Enterprise Security

Hi Splunk Community, Splunk Platform has set a great foundation for your security operations. With the ...

Splunk Admins and App Developers | Earn a $35 gift card!

Splunk, in collaboration with ESG (Enterprise Strategy Group) by TechTarget, is excited to announce a ...