Splunk Enterprise Security

Metrics definition errors in the add-on - is fix available in future version?

lakshman239
SplunkTrust
SplunkTrust

The latest add-on 4.6.0 installed on splunk 7.1.3, when restarted throws an the following error: Any plans to fix them sooner?

            Invalid key in stanza [aws:cloudwatch:metric] in /opt/splunk/etc/apps/Splunk_TA_aws/default/props.conf, line 242: METRIC-SCHEMA-TRANSFORMS  (value:  metric-schema:aws_cloudwatch_metric_schema).

            Invalid key in stanza [eval_aws_metric_name_prefix] in /opt/splunk/etc/apps/Splunk_TA_aws/default/transforms.conf, line 75: INGEST_EVAL  (value:  metric_name = Namespace.".".MetricName).

            Invalid key in stanza [metric-schema:aws_cloudwatch_metric_schema] in /opt/splunk/etc/apps/Splunk_TA_aws/default/transforms.conf, line 78: METRIC-SCHEMA-MEASURES  (value:  SampleCount,Average,Sum,Minimum,Maximum).

            Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check –debug
0 Karma
1 Solution

lakshman239
SplunkTrust
SplunkTrust

Adding the below as its now available in release notes as Known Issue - ADDON-19138 and will be supported from Splunk 7.2+

View solution in original post

0 Karma

lakshman239
SplunkTrust
SplunkTrust

Adding the below as its now available in release notes as Known Issue - ADDON-19138 and will be supported from Splunk 7.2+

View solution in original post

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!