Splunk Enterprise

Invalid Key in alert_actions.conf after upgrade to Splunk 9.0.0?

dasadmin
Explorer

Hello

Upgraded Splunk Enterprise to 9.0.0 today - went OK.

Upgraded Splunk Universal Forwarders on Windows Server 2019 to 9.0.0 - upgrade says all went OK.

I opened cmd and executed splunk restart

The SplunkForwarder restarts OK, but I get the following error:

 

 

Invalid key in stanza [webhook] in D:\Program Files\SplunkUniversalForwarder\etc\system\default\alert_actions.conf, line 229: enable_allowlist (value: false)

 

 

In the file alert_actions.conf on line 229:

 

 

[webhook]
enable_allowlist = false

 

 

 

Anyone know why I'm seeing this after the upgrade?

Thanks

Labels (2)

Skeer-Jamf
Path Finder

Getting this error when either: installing fresh 9.1.0.1 or upgrading 8.x to 9.1.  This is just sad.. I mean how could Splunk have NOT fixed this in over a year??

Obviously the syntax changed.. can't be that hard to figure out why.

computermathguy
Explorer

Getting the same warning.  I'll submit a support ticket.

0 Karma

ivarbaba
New Member

I have the same problem. Did you get a fix?

0 Karma

tro
Path Finder

You you are having same issue, then it is fixed in version Splunk 9.0.4. Please do update 😉

0 Karma

chadmedeiros
Path Finder

this is not fixed in 9.0.4

sumedhjoglekar
Loves-to-Learn Lots

Were you able to find any solution to this issue ?

0 Karma

dasadmin
Explorer

hello

I opened a case with splunk and they said don't worry about the error unless it is causing an issue.

It has been forwarded to splunk engineering to look at further.

Thx

tro
Path Finder

I'm so disappointed by Splunk release process that they even don't run "splunk btool check" in their testing pipelines to catch this kind of errors 🙄.

mhanisch_kvd
Observer

Happy new year everyone!

I want to ask, if there is an update about this issue? We updated our Splunk Server and universal forwarder to the latest version 9.0.2 yet and ran into the same issue on some machines.

Splunk and the forwarder seems to operate as intended, but we get this errors in the log on some hosts:

 

Dec 12 15:14:26 somehostname-123 splunk[2268]: Invalid key in stanza [webhook] in /opt/splunkforwarder/etc/system/default/alert_actions.conf, line 229: enable_allowlist (value: false).
Dec 12 15:14:26 somehostname-123 splunk[2268]: Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug' 
0 Karma

tro
Path Finder

I got this answer via official Splunk support:

Ticket raised to our developers: SPL-229404.
 
In general fix in new app version was already implemented. But app is still not ready to be released due to some other things which have to be tested.
Unfortunately I don't have any specific ETA for now but I believe it should not take too long.

So I would suggest watch SPL-229404 in upcoming changelogs.
0 Karma

lbdatpsu
Engager

Fwiw, the problem is still there in UF 9.0.4.

chadmedeiros
Path Finder

Honestly. Nearly 1 year later and 2 version revisions and every fresh UF install done on every server throws this out-of-the-box warning. Not at all impressed

achavarria
Engager

Getting the same issue in my environment after upgrading my universal forwarders to 9.0.0

isoutamo
SplunkTrust
SplunkTrust

If this has worked earlier, you should report that to splunk support.

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

at lest I cannot found that parameter from conf file description. Are you sure that you haven’t gotten that warning earlier?

r. Ismo 

0 Karma

dasadmin
Explorer

Hello

I get the message across all the Windows clients when I restart the client:

 

Error when startingError when startingOutput of splunk btool check --debug (pt1)Output of splunk btool check --debug (pt1)Output of splunk btool check --debug (pt2)Output of splunk btool check --debug (pt2)

0 Karma

isoutamo
SplunkTrust
SplunkTrust
As you get it from etc/system/default directory and you haven't changed it, you should report this to Splunk via support portal.
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...