Monitoring Splunk

Unable to find solution for error in splunkd log file

shreyasathavale
Communicator

Hey I am getting this error in splunkd log file, I am unable to understand what is the error. The error is

SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='delimExtractionsIIS2003-WEB'

Tags (1)
1 Solution

lguinn2
Legend

I suspect that you have an invalid attribute specified in one of your transforms.conf files. See if this will find it for you:

Go to the Splunk bin directory ($SPLUNK_HOME/bin)

./splunk btool check

OR, for Windows

splunk btool check

btool checks the configuration files and notifies you of any suspicious or invalid settings. You can also use the Splunk-on-Splunk app (SOS) to perform this and many other diagnostic checks.

btool

View solution in original post

lguinn2
Legend

I suspect that you have an invalid attribute specified in one of your transforms.conf files. See if this will find it for you:

Go to the Splunk bin directory ($SPLUNK_HOME/bin)

./splunk btool check

OR, for Windows

splunk btool check

btool checks the configuration files and notifies you of any suspicious or invalid settings. You can also use the Splunk-on-Splunk app (SOS) to perform this and many other diagnostic checks.

btool

shreyasathavale
Communicator

Thanks lguinn , I found that DELIMS was set to nothing
It was : DELIMS=
I will be correcting it to : DELIMS= " "

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...