I upgraded to Splunk 6.2.2 and now get errors with Splunk App for Nix and Windows.


I now get these messages when the indexers start up:

  Checking filesystem compatibility...  Done
    Checking conf files for problems...
            Improper stanza [dhcpd_server_dhcprelease] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 30
            Value in stanza [app=/network/ntp:default] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 783 not URI encoded: app = /network/ntp:default
            Value in stanza [shell=/bin/bash] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 835 not URI encoded: shell = /bin/bash
            Value in stanza [shell=/bin/sh] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 838 not URI encoded: shell = /bin/sh
            Value in stanza [shell=/usr/bin/bash] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 841 not URI encoded: shell = /usr/bin/bash
            Value in stanza [shell=/usr/bin/pfksh] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 844 not URI encoded: shell = /usr/bin/pfksh
            Value in stanza [shell=/usr/bin/pfsh] in /splunk/etc/apps/Splunk_TA_nix/default/tags.conf, line 847 not URI encoded: shell = /usr/bin/pfsh
            Value in stanza [Service_Name=kadmin/changepw] in /splunk/etc/apps/Splunk_TA_windows/default/tags.conf, line 135 not URI encoded: Service_Name = kadmin/changepw
            Value in stanza [app=win:local] in /splunk/etc/apps/Splunk_TA_windows/default/tags.conf, line 198 not URI encoded: app = win:local
            Value in stanza [app=win:remote] in /splunk/etc/apps/Splunk_TA_windows/default/tags.conf, line 201 not URI encoded: app = win:remote
            Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'

All preliminary checks passed.

Has anyone seen this? What is the fix?

Tags (2)


so if you manage the ta under your deployment server and upgrade the app to the latest version while your deployment server is also on the latest version of splunk, what will happen to the older instances of splunk that do not complain about url encoded stanzas? can someone confirm backwards compatibility?

0 Karma


It looks like 6.2 wants the tag to be url encoded, not "[shell=/bin/bash" but rather "[shell=%2Fbin%2Fbash]". But like phoffman said, update to latest version and it should be ok.


Try replacing the ':' in tags.conf with '_'

0 Karma

Splunk Employee
Splunk Employee

What version are your NIX and Windows apps? You will want to verify you are on the latest version.


I downvoted this post because this isn't an answer. it's simply a question for more information.

0 Karma


No, it's a suggestion to update to the latest version, which is also the resolution to this issue.

0 Karma
Get Updates on the Splunk Community!

Splunk Security Content for Threat Detection & Response, Q1 Roundup

Join Principal Threat Researcher, Michael Haag, as he walks through:An introduction to the Splunk Threat ...

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! 🌈 In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...