Splunk Enterprise

Invalid key in stanza [webhook] alert_actions.conf splunk forwarder

spisiakmi
Contributor

Hi, can anybody help, please?

I'm using Splunk Universal Forwarder 9.0.4 (build de405f4a7979) and from 15.07.2023 I have no indexed data in Splunk. .After restart there is only 1 error:

Invalid key in stanza [webhook] in C:\Program Files\SplunkUniversalForwarder\etc\system\default\alert_actions.conf, line 229: enable_allowlist (value: false).
Your indexes and inputs configurations are not internally consistent. For more information, run 'splunk btool check --debug'

I tried this step:

1. removed 
[webhook]
enable_allowlist = false

or

2. changed it into true

nothing helped. Any advice, please?

 

Labels (1)
0 Karma
1 Solution

spisiakmi
Contributor

The problem has been fixed by splunk admins. Unfortunately I don't know how. Problem appeared when they deleted old indexers from the cluster and the still have been configured on the FW side.

View solution in original post

0 Karma

spisiakmi
Contributor

The problem has been fixed by splunk admins. Unfortunately I don't know how. Problem appeared when they deleted old indexers from the cluster and the still have been configured on the FW side.

0 Karma

m_pham
Splunk Employee
Splunk Employee

I doubt that error is causing your data ingest issue, since "enable_allowlist" appears to be an invalid option for the alert_actions.conf file that came with the Splunk UF software. You can safely ignore that error.

It's also a known issue on Splunk UF v9.0.4: https://community.splunk.com/t5/Splunk-Enterprise/Invalid-Key-in-alert-actions-conf-after-upgrade-to...

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...