I upgraded to Splunk 6.2.2 and now get errors with Splunk App for Nix and Windows.

[bgamblin]

I now get these messages when the indexers start up:

  Checking filesystem compatibility...  Done
    Checking conf files for problems...
            Improper stanza [dhcpd_server_dhcprelease] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 30
            Value in stanza [app=/network/ntp:default] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 783 not URI encoded: app = /network/ntp:default
            Value in stanza [shell=/bin/bash] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 835 not URI encoded: shell = /bin/bash
            Value in stanza [shell=/bin/sh] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 838 not URI encoded: shell = /bin/sh
            Value in stanza [shell=/usr/bin/bash] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 841 not URI encoded: shell = /usr/bin/bash
            Value in stanza [shell=/usr/bin/pfksh] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 844 not URI encoded: shell = /usr/bin/pfksh
            Value in stanza [shell=/usr/bin/pfsh] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 847 not URI encoded: shell = /usr/bin/pfsh
            Value in stanza [Service_Name=kadmin/changepw] in /splunk/etc/apps/Splunk_TA_windows/default/tags.conf, line 135 not URI encoded: Service_Name = kadmin/changepw
            Value in stanza [app=win:local] in /splunk/etc/apps/Splunk_TA_windows/default/tags.conf, line 198 not URI encoded: app = win:local
            Value in stanza [app=win:remote] in /splunk/etc/apps/Splunk_TA_windows/default/tags.conf, line 201 not URI encoded: app = win:remote
            Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'
    Done

All preliminary checks passed.

Has anyone seen this? What is the fix?

[ben_leung]

so if you manage the ta under your deployment server and upgrade the app to the latest version while your deployment server is also on the latest version of splunk, what will happen to the older instances of splunk that do not complain about url encoded stanzas? can someone confirm backwards compatibility?

[mikelanghorst]

It looks like 6.2 wants the tag to be url encoded, not "[shell=/bin/bash" but rather "[shell=%2Fbin%2Fbash]". But like phoffman said, update to latest version and it should be ok.

[ski98033]

Try replacing the ':' in tags.conf with '_'

[phoffman_splunk]

What version are your NIX and Windows apps? You will want to verify you are on the latest version.

[tim_connolly]

I downvoted this post because this isn't an answer. it's simply a question for more information.

[alekksi]

No, it's a suggestion to update to the latest version, which is also the resolution to this issue.