- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hey I am getting this error in splunkd log file, I am unable to understand what is the error. The error is
SearchOperator:kv - Invalid key-value parser, ignoring it, transform_name='delimExtractionsIIS2003-WEB'
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I suspect that you have an invalid attribute specified in one of your transforms.conf files. See if this will find it for you:
Go to the Splunk bin directory ($SPLUNK_HOME/bin)
./splunk btool check
OR, for Windows
splunk btool check
btool checks the configuration files and notifies you of any suspicious or invalid settings. You can also use the Splunk-on-Splunk app (SOS) to perform this and many other diagnostic checks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I suspect that you have an invalid attribute specified in one of your transforms.conf files. See if this will find it for you:
Go to the Splunk bin directory ($SPLUNK_HOME/bin)
./splunk btool check
OR, for Windows
splunk btool check
btool checks the configuration files and notifies you of any suspicious or invalid settings. You can also use the Splunk-on-Splunk app (SOS) to perform this and many other diagnostic checks.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thanks lguinn , I found that DELIMS was set to nothing
It was : DELIMS=
I will be correcting it to : DELIMS= " "
