Why am I receiving these errors on startup of WAS Universal Forwarder

[jchilovich]

upon startup of universal forwarder in a WAS environment, I receive the following (many of them, this is just an example). App does start and execute.

Possible typo in stanza [WebSphere:ActivityLog] in /local/home/a_was0/splunkforwarder/etc/apps/splunk_forwarder_addon_was/default/props.conf, line 194:
TRANSFORM-was_host = host-extract

Possible typo in stanza [WebSphere:ActivityLog] in /local/home/a_was0/splunkforwarder/etc/apps/splunk_forwarder_addon_was/default/props.conf,
line 195: TRANSFORM-profile = profile-extract

I look here as per docs: $SPLUNK_HOME/splunkforwarder/etc/system/default/ and find no transforms.conf file.
Instead I find it in:/.../splunkforwarder/etc/apps/splunk_forwarder_addon_was/default

in Transforms.conf:

[host-extract]
SOURCE_KEY = MetaData:Host
REGEX = host::(.+)
FORMAT = was_host::"$1"
WRITE_META = true

[profile-extract]
SOURCE_KEY = MetaData:Source
REGEX = profiles\W{1,2}([\w-.]+)
FORMAT = profile::"$1"

WRITE_META = true

Ran the following: 'splunk btool check --debug'

Possible typo in stanza [WebSphere:ActivityLog] in /.../splunkforwarder/etc/apps/splunk_forwarder_addon_was/default/props.conf, line 194: TRANSFORM-was_host = host-extract
Did you mean 'TIME_FORMAT'?
Did you mean 'TIME_PREFIX'?
Did you mean 'TRANSFORMS-'?
Did you mean 'TRANSFORMS-colorchange'?
Did you mean 'TRUNCATE'?
Did you mean 'TZ'?
Did you mean 'TZ_ALIAS'?
Did you mean 'This means that if you have e.g. EVAL-x'?
Did you mean 'the default event boundary detection (BREAK_ONLY_BEFORE_DATE'?

Also see this in the output:
No spec file for: /.../splunkforwarder/etc/apps/splunk_forwarder_addon_was/default/transforms.conf
No spec file for: /.../splunkforwarder/etc/system/default/app.conf
No spec file for: /.../splunkforwarder/etc/system/default/conf.conf
No spec file for: /.../splunkforwarder/etc/system/local/deploymentclient.conf

I'm still learning but what am I missing?
Is the transforms.conf in incorrect spot?
Are there parms I'm to add in one of these files?

[eichfuss]

A very simple solution to get the app working. The problem is existing over two years, so why not updating the App and publish a working version of the app?

[jchilovich]

mad4wknds,
It's been a while since I had this issue but, after I updated all the TRANSFORM references, I had not additional problems. Using the btool --debug ( 'splunk btool check --debug' ) worked great since it identified lines I looked over.

[jchilovich]

mad4wknds,
It's been a while since I had this issue but, after I updated all the TRANSFORM references, I had not additional problems. Using the btool --debug ( 'splunk btool check --debug' ) worked great since it identified lines I looked over.

[jchilovich]

Excellent. Thank you. that fixed the errors. can't believe I didn't catch that simple change.

[jchilovich]

mad4wknds, I posted my comments above.

[mad4wknds]

I had the very same exact issue with the "S" being dropped. How did you solve the issue of "No Spec file for:"

[jchilovich]

Excellent. Thank you. that fixed the errors. can't believe I didn't catch that simple change.

[bshuler_splunk · Accepted solution]

Change TRANSFORM in default/props.conf to TRANSFORMS