Getting Data In

what is this typos in outputs.conf ?

sieutruc
Contributor

Hello

I got a strange error as:

Checking conf files for typos...
Possible typo in stanza [indexAndForward] in /opt/splunk/etc/apps/linuxForwarder_output/default/outputs.conf, line 8: selectiveIndexing = true
There might be typos in your conf files. For more information, run 'splunk btool check --debug'

and my outputs.conf is


[tcpout]
defaultGroup = noforward
disabled=false
[indexAndForward]
index=true
selectiveIndexing=true
[tcpout:indexer01]
server=178.17.0.46:9997
[tcpout:indexer02]
server=178.17.0.47:9997

Can you show me why ? i just only copied the word and it seems not to have any erro

Tags (1)
1 Solution

yannK
Splunk Employee
Splunk Employee

The configurations typo check is compared to the spec files stored in system/README, example for outputs.conf
$SPLUNK_HOME/etc/system/README/outputs.conf.spec

I checked the spec and the parameter "selectiveIndexing" is not listed. While it is mentioned on the documentation there : http://docs.splunk.com/Documentation/Splunk/4.3.4/Deploy/Routeandfilterdatad
It may be an obscure missing parameter in the spec, or a mistake in the docs, let me open a bug to find out.

Except the typo warning, is your configuration working ?

View solution in original post

bmacias84
Champion

@sieutruc, I don't see anything outright. You could have a char outside the standard unicode table causing Splunk to choke. Also have you edited your inputs.conf to have explicity target groups, but I am guessing you are not getting that far.

I would try using:


./splunk cmd btool check -dir=/opt/splunk/etc/apps/linuxForwarder_output/default outputs --debug


./splunk cmd btool dir=/opt/splunk/etc/apps/linuxForwarder_output/default outputs list --debug

This might help display where exactly.

Usebtooltotroubleshootconfigurations

Note: btool is not tested by Splunk and is not officially supported or guaranteed. That said, it's what our Support team uses when trying to troubleshoot your issues.

Hope this helps.

0 Karma

sieutruc
Contributor

Yes, i did. I configured the inputs.conf to have explicit target groups. I let all configuration file in my office. In fact, i don't understand why it caused an error. I see it run in splunkd log, but without sending externally or locally indexing.
I used winscp edit tool that runs fine until now, just only this time got a problem.
Maybe i'll contact Splunk support if it doesn't work

0 Karma

yannK
Splunk Employee
Splunk Employee

The configurations typo check is compared to the spec files stored in system/README, example for outputs.conf
$SPLUNK_HOME/etc/system/README/outputs.conf.spec

I checked the spec and the parameter "selectiveIndexing" is not listed. While it is mentioned on the documentation there : http://docs.splunk.com/Documentation/Splunk/4.3.4/Deploy/Routeandfilterdatad
It may be an obscure missing parameter in the spec, or a mistake in the docs, let me open a bug to find out.

Except the typo warning, is your configuration working ?

sieutruc
Contributor

So what should i do now ? do i need to update Splunk instance ?

0 Karma

yannK
Splunk Employee
Splunk Employee

I confirm this seems to be a bug in 4.3.*, the ref is SPL-55915

0 Karma

sieutruc
Contributor

all the configuration worked, the data go from another Universal Forwarder to that machine is transfered to indexer01 and indexer02. But the local input data that i used in inputs.conf:
[inputdata]
_TCP_ROUTING = indexer01
it doesn't be sent to indexer01
that all what i want to say

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...