Monitoring Splunk

"Cannot parse into key-value pair" error after upgrading to 4.1.4

Lowell
Super Champion

I just upgraded one of my splunk forwarders to version 4.1.4 and now I'm seeing the following error message in my internal logs:

WARN IniFile - C:\Program Files\Splunk\etc\apps\search\default\inputs.conf, line: 2: Cannot parse into key-value pair: This file intentionally left empty. Please do not delete it

Tags (2)

Lowell
Super Champion

This problem is caused by a bogus configuration file entry. To prevent this error message, open up your $SPLUNK_HOME/etc/apps/search/default/inputs.conf config file, which could contain the following:

# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved.  Version 4.1.4
This file intentionally left empty. Please do not delete it.

Simply remove or comment out (add a "#") to the second line and the error message will go away.


Example of a fixed file:

# Copyright (C) 2005-2010 Splunk Inc.  All Rights Reserved.  Version 4.1.4
# This file intentionally left empty. Please do not delete it.
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Thanks for the Memories: .conf26 Took Learning to New Heights

Thank you, Splunk Community, for making .conf26 in Denver one for the books. From packed Splunk University ...

Best Practices: Splunk auto adjust pipeline queue

When you enable autoAdjustQueue in Splunk, maxSize should be understood as the queue size Splunk starts with ...

Splunk Auto Ingestion Parallel Pipeline Scaling

Why this feature matters Many Splunk environments experience ingestion pressure long before the host is fully ...