Getting Data In

Why am I receiving these errors on startup of WAS Universal Forwarder

jchilovich
New Member

upon startup of universal forwarder in a WAS environment, I receive the following (many of them, this is just an example). App does start and execute.

Possible typo in stanza [WebSphere:ActivityLog] in /local/home/a_was0/splunkforwarder/etc/apps/splunk_forwarder_addon_was/default/props.conf, line 194:
TRANSFORM-was_host = host-extract

Possible typo in stanza [WebSphere:ActivityLog] in /local/home/a_was0/splunkforwarder/etc/apps/splunk_forwarder_addon_was/default/props.conf,
line 195: TRANSFORM-profile = profile-extract

I look here as per docs: $SPLUNK_HOME/splunkforwarder/etc/system/default/ and find no transforms.conf file.
Instead I find it in:/.../splunkforwarder/etc/apps/splunk_forwarder_addon_was/default

in Transforms.conf:

[host-extract]
SOURCE_KEY = MetaData:Host
REGEX = host::(.+)
FORMAT = was_host::"$1"
WRITE_META = true

[profile-extract]
SOURCE_KEY = MetaData:Source
REGEX = profiles\W{1,2}([\w-.]+)
FORMAT = profile::"$1"

WRITE_META = true

Ran the following: 'splunk btool check --debug'

Possible typo in stanza [WebSphere:ActivityLog] in /.../splunkforwarder/etc/apps/splunk_forwarder_addon_was/default/props.conf, line 194: TRANSFORM-was_host = host-extract
Did you mean 'TIME_FORMAT'?
Did you mean 'TIME_PREFIX'?
Did you mean 'TRANSFORMS-'?
Did you mean 'TRANSFORMS-colorchange'?
Did you mean 'TRUNCATE'?
Did you mean 'TZ'?
Did you mean 'TZ_ALIAS'?
Did you mean 'This means that if you have e.g. EVAL-x'?
Did you mean 'the default event boundary detection (BREAK_ONLY_BEFORE_DATE'?

Also see this in the output:
No spec file for: /.../splunkforwarder/etc/apps/splunk_forwarder_addon_was/default/transforms.conf
No spec file for: /.../splunkforwarder/etc/system/default/app.conf
No spec file for: /.../splunkforwarder/etc/system/default/conf.conf
No spec file for: /.../splunkforwarder/etc/system/local/deploymentclient.conf

I'm still learning but what am I missing?
Is the transforms.conf in incorrect spot?
Are there parms I'm to add in one of these files?

Tags (3)
0 Karma
1 Solution

bshuler_splunk
Splunk Employee
Splunk Employee

Change TRANSFORM in default/props.conf to TRANSFORMS

View solution in original post

eichfuss
Path Finder

A very simple solution to get the app working. The problem is existing over two years, so why not updating the App and publish a working version of the app?

0 Karma

jchilovich
New Member

mad4wknds,
It's been a while since I had this issue but, after I updated all the TRANSFORM references, I had not additional problems. Using the btool --debug ( 'splunk btool check --debug' ) worked great since it identified lines I looked over.

0 Karma

jchilovich
New Member

mad4wknds,
It's been a while since I had this issue but, after I updated all the TRANSFORM references, I had not additional problems. Using the btool --debug ( 'splunk btool check --debug' ) worked great since it identified lines I looked over.

0 Karma

jchilovich
New Member

Excellent. Thank you. that fixed the errors. can't believe I didn't catch that simple change.

0 Karma

jchilovich
New Member

mad4wknds, I posted my comments above.

0 Karma

mad4wknds
Path Finder

I had the very same exact issue with the "S" being dropped. How did you solve the issue of "No Spec file for:"

0 Karma

jchilovich
New Member

Excellent. Thank you. that fixed the errors. can't believe I didn't catch that simple change.

0 Karma

bshuler_splunk
Splunk Employee
Splunk Employee

Change TRANSFORM in default/props.conf to TRANSFORMS

View solution in original post

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!