typo on inputs.conf for splunktcp-ssl compressed option

[mataharry]

Since I upgraded to 6.0, I see this warning
Possible typo in stanza [splunktcp-ssl:9997] in /splunk/etc/system/local/inputs.conf, line 5: compressed = true
Did you mean 'concurrentChannelLimit'?
Did you mean 'connection_host'?

[ekost · Accepted solution]

After upgrading to Splunk 5.0.4 or later, the "Possible typo in stanza ... compressed = true" on stdout will be displayed if Splunk was configured to use a combination of SSL compression and the non-SSL compression.
Until you plan to change the non-SSL compression setting on all of the forwarders, do not remove this setting from the inputs.conf after upgrading; changing it will block all forwarder communications that attempt to use non-SSL compression.

The typo warning is about a deprecated setting for SSL communications only. The warning does not stop the port from accepting inbound communications from a forwarder using both compression options. The forwarders will continue to function normally.
The compression setting is required to be synchronized between the outputs.conf on the forwarders and the inputs.conf on the indexers. Splunk does not dynamically adapt to compression settings.

Prior to Splunk 4.3, the setting for Splunk-to-Splunk communications using the setting 'compressed = true' was applicable to both SSL and non-SSL forwarder communications.
The behavior for the setting changed after version 4.3.1 so that *compressed = tru*e applies to non-SSL forwarder communications only.
SSL compression is managed by the setting useClientSSLCompression in server.conf and is enabled by default.

[yannK]

In latest splunk 5.* and 6., the option **compressed* has been removed from the inputs for splunktcp-ssl stanza.

[EDIT]
this is causing typo warnings. Beware, the indexer does not honor the forwarder configuration. If you have compression setup on the old forwarders, you need to have the same at the indexer level.