Why do I get "Invalid key in stanza..."

[JarrettM]

Deploying app to collect IIS logs. When restarting the forwarder get the following:
" Invalid key in stanza [monitor:E:\AirWatch\Logs\IIS\] in E:\SplunkUniversalForwarder\etc\apps\IIS\default\inputs.conf, line 7: whitelist (value: \.log$). Your indexes and inputs configurations are not internally consistent"
Runninf splunk btool gives no further info.
Here is the entire inputs.conf:

[monitor:e:\AirWatch\Logs\IIS
disabled=false
sourcetype=iis
whitelist=\.logs$

[493669]

try this:

 [monitor://e:\AirWatch\Logs\IIS]
 disabled = 0
 sourcetype = iis
 whitelist = \.logs$

[JarrettM]

You got it! Sorry I can't mark your answer as accepted. Someone else beat you by 4 minutes!

Thanks!!

[mayurr98 · Accepted solution]

Hey check the syntax of monitor stanza

[monitor://e:\AirWatch\Logs\IIS]
disabled = 0
sourcetype = iis
whitelist = \.logs$

You need to add your path after [monitor://<your_path>]
Also to monitor file with the .logextension, you should write \.log$
You can find this in
https://docs.splunk.com/Documentation/SplunkCloud/6.6.3/Data/Whitelistorblacklistspecificincomingdat...
Let me know if this helps!

[JarrettM]

That did it. Pretty stupid on my part!

Thanks!!