Getting Data In

Why am I receiving these errors on startup of WAS Universal Forwarder

jchilovich
New Member

upon startup of universal forwarder in a WAS environment, I receive the following (many of them, this is just an example). App does start and execute.

Possible typo in stanza [WebSphere:ActivityLog] in /local/home/a_was0/splunkforwarder/etc/apps/splunk_forwarder_addon_was/default/props.conf, line 194:
TRANSFORM-was_host = host-extract

Possible typo in stanza [WebSphere:ActivityLog] in /local/home/a_was0/splunkforwarder/etc/apps/splunk_forwarder_addon_was/default/props.conf,
line 195: TRANSFORM-profile = profile-extract

I look here as per docs: $SPLUNK_HOME/splunkforwarder/etc/system/default/ and find no transforms.conf file.
Instead I find it in:/.../splunkforwarder/etc/apps/splunk_forwarder_addon_was/default

in Transforms.conf:

[host-extract]
SOURCE_KEY = MetaData:Host
REGEX = host::(.+)
FORMAT = was_host::"$1"
WRITE_META = true

[profile-extract]
SOURCE_KEY = MetaData:Source
REGEX = profiles\W{1,2}([\w-.]+)
FORMAT = profile::"$1"

WRITE_META = true

Ran the following: 'splunk btool check --debug'

Possible typo in stanza [WebSphere:ActivityLog] in /.../splunkforwarder/etc/apps/splunk_forwarder_addon_was/default/props.conf, line 194: TRANSFORM-was_host = host-extract
Did you mean 'TIME_FORMAT'?
Did you mean 'TIME_PREFIX'?
Did you mean 'TRANSFORMS-'?
Did you mean 'TRANSFORMS-colorchange'?
Did you mean 'TRUNCATE'?
Did you mean 'TZ'?
Did you mean 'TZ_ALIAS'?
Did you mean 'This means that if you have e.g. EVAL-x'?
Did you mean 'the default event boundary detection (BREAK_ONLY_BEFORE_DATE'?

Also see this in the output:
No spec file for: /.../splunkforwarder/etc/apps/splunk_forwarder_addon_was/default/transforms.conf
No spec file for: /.../splunkforwarder/etc/system/default/app.conf
No spec file for: /.../splunkforwarder/etc/system/default/conf.conf
No spec file for: /.../splunkforwarder/etc/system/local/deploymentclient.conf

I'm still learning but what am I missing?
Is the transforms.conf in incorrect spot?
Are there parms I'm to add in one of these files?

Tags (3)
0 Karma
1 Solution

bshuler_splunk
Splunk Employee
Splunk Employee

Change TRANSFORM in default/props.conf to TRANSFORMS

View solution in original post

eichfuss
Path Finder

A very simple solution to get the app working. The problem is existing over two years, so why not updating the App and publish a working version of the app?

0 Karma

jchilovich
New Member

mad4wknds,
It's been a while since I had this issue but, after I updated all the TRANSFORM references, I had not additional problems. Using the btool --debug ( 'splunk btool check --debug' ) worked great since it identified lines I looked over.

0 Karma

jchilovich
New Member

mad4wknds,
It's been a while since I had this issue but, after I updated all the TRANSFORM references, I had not additional problems. Using the btool --debug ( 'splunk btool check --debug' ) worked great since it identified lines I looked over.

0 Karma

jchilovich
New Member

Excellent. Thank you. that fixed the errors. can't believe I didn't catch that simple change.

0 Karma

jchilovich
New Member

mad4wknds, I posted my comments above.

0 Karma

mad4wknds
Path Finder

I had the very same exact issue with the "S" being dropped. How did you solve the issue of "No Spec file for:"

0 Karma

jchilovich
New Member

Excellent. Thank you. that fixed the errors. can't believe I didn't catch that simple change.

0 Karma

bshuler_splunk
Splunk Employee
Splunk Employee

Change TRANSFORM in default/props.conf to TRANSFORMS

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...