Installation

I upgraded to Splunk 6.2.2 and now get errors with Splunk App for Nix and Windows.

bgamblin
Explorer

I now get these messages when the indexers start up:

  Checking filesystem compatibility...  Done
    Checking conf files for problems...
            Improper stanza [dhcpd_server_dhcprelease] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 30
            Value in stanza [app=/network/ntp:default] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 783 not URI encoded: app = /network/ntp:default
            Value in stanza [shell=/bin/bash] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 835 not URI encoded: shell = /bin/bash
            Value in stanza [shell=/bin/sh] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 838 not URI encoded: shell = /bin/sh
            Value in stanza [shell=/usr/bin/bash] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 841 not URI encoded: shell = /usr/bin/bash
            Value in stanza [shell=/usr/bin/pfksh] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 844 not URI encoded: shell = /usr/bin/pfksh
            Value in stanza [shell=/usr/bin/pfsh] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 847 not URI encoded: shell = /usr/bin/pfsh
            Value in stanza [Service_Name=kadmin/changepw] in /splunk/etc/apps/Splunk_TA_windows/default/tags.conf, line 135 not URI encoded: Service_Name = kadmin/changepw
            Value in stanza [app=win:local] in /splunk/etc/apps/Splunk_TA_windows/default/tags.conf, line 198 not URI encoded: app = win:local
            Value in stanza [app=win:remote] in /splunk/etc/apps/Splunk_TA_windows/default/tags.conf, line 201 not URI encoded: app = win:remote
            Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
    Done

All preliminary checks passed.

Has anyone seen this? What is the fix?

Tags (2)

ben_leung
Builder

so if you manage the ta under your deployment server and upgrade the app to the latest version while your deployment server is also on the latest version of splunk, what will happen to the older instances of splunk that do not complain about url encoded stanzas? can someone confirm backwards compatibility?

0 Karma

mikelanghorst
Motivator

It looks like 6.2 wants the tag to be url encoded, not "[shell=/bin/bash" but rather "[shell=%2Fbin%2Fbash]". But like phoffman said, update to latest version and it should be ok.

ski98033
Explorer

Try replacing the ':' in tags.conf with '_'

0 Karma

phoffman_splunk
Splunk Employee
Splunk Employee

What version are your NIX and Windows apps? You will want to verify you are on the latest version.

tim_connolly
Engager

I downvoted this post because this isn't an answer. it's simply a question for more information.

0 Karma

alekksi
Communicator

No, it's a suggestion to update to the latest version, which is also the resolution to this issue.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...