Monitoring Splunk

Unable to find solution for error in splunkd log file

shreyasathavale
Communicator

Hey I am getting this error in splunkd log file, I am unable to understand what is the error. The error is

SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='delimExtractionsIIS2003-WEB'

Tags (1)
1 Solution

lguinn2
Legend

I suspect that you have an invalid attribute specified in one of your transforms.conf files. See if this will find it for you:

Go to the Splunk bin directory ($SPLUNK_HOME/bin)

./splunk btool check

OR, for Windows

splunk btool check

btool checks the configuration files and notifies you of any suspicious or invalid settings. You can also use the Splunk-on-Splunk app (SOS) to perform this and many other diagnostic checks.

btool

View solution in original post

lguinn2
Legend

I suspect that you have an invalid attribute specified in one of your transforms.conf files. See if this will find it for you:

Go to the Splunk bin directory ($SPLUNK_HOME/bin)

./splunk btool check

OR, for Windows

splunk btool check

btool checks the configuration files and notifies you of any suspicious or invalid settings. You can also use the Splunk-on-Splunk app (SOS) to perform this and many other diagnostic checks.

btool

shreyasathavale
Communicator

Thanks lguinn , I found that DELIMS was set to nothing
It was : DELIMS=
I will be correcting it to : DELIMS= " "

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...