About ketilolav

ketilolav · ‎08-18-2021

Hi @govindashwin8 , What version are you running on. I'm having bundle issues with indexers running Splunk 8.0, but not with indexers running 8.2.1. My search heads are running 8.2.1

ketilolav · ‎08-17-2021

Hi, Transforms.conf is part of the TA, BUT transforms should be done on the indexer. The forwarder doesn’t know this, and does not have a transforms.conf.spec file because it is not anticipating having to do any of that work. That is where the errors come in. Modify the TA when putting it on the UF by adjusting (or removing) said files. In my case, I renamed the transforms.conf to transforms.conf.old. (2) ignore the messages, as it will work fine anyway. Then I deployed the transforms.conf to my indexers. Hope this gives you some clarity about what's going on. Best,

ketilolav · ‎08-04-2021

Hi, I just discovered a CLI command you can run to see the active forwarders your UF/HF are talking to: $SPLUNK_HOME/bin/splunk list forward-server will list in memory peer nodes the UF/HF is talking to.

ketilolav · ‎06-22-2021

Hi, I just installed Splunk_TA_windows on my windows 2016 server. The server is running the splunk uf version 7.3.x and this is a new install. I am getting this error msg during startup of the Splunk UF and when I run the btool command 'C:\Program Files\splunkuniversalforwarder\bin\splunk.exe' btool check debug Checking: C:\Program Files\splunkuniversalforwarder\etc\apps\Splunk_TA_windows\default\transforms.conf Invalid key in stanza [user_account_control_property] in C:\Program Files\splunkuniversalforwarder\etc\apps\Splunk_TA_windows\default\transforms.conf, line 10: external_cmd (value: user_account_control_property.py user AccountControl userAccountPropertyFlag). Invalid key in stanza [user_account_control_property] in C:\Program Files\splunkuniversalforwarder\etc\apps\Splunk_TA_windows\default\transforms.conf, line 11: external_type (value: python). Invalid key in stanza [user_account_control_property] in C:\Program Files\splunkuniversalforwarder\etc\apps\Splunk_TA_windows\default\transforms.conf, line 12: fields_list (value: userAccountControl,userAccountProperty Flag). Invalid key in stanza [dhcp_discard_headers] in C:\Program Files\splunkuniversalforwarder\etc\apps\Splunk_TA_windows\default\transforms.conf, line 19: REGEX (value: ^(?:[^\d]+|\d+[^\d,])). Invalid key in stanza [dhcp_discard_headers] in C:\Program Files\splunkuniversalforwarder\etc\apps\Splunk_TA_windows\default\transforms.conf, line 20: DEST_KEY (value: queue). Invalid key in stanza [dhcp_discard_headers] in C:\Program Files\splunkuniversalforwarder\etc\apps\Splunk_TA_windows\default\transforms.conf, line 21: FORMAT (value: nullQueue). Invalid key in stanza [auto_kv_for_microsoft_dhcp] in C:\Program Files\splunkuniversalforwarder\etc\apps\Splunk_TA_windows\default\transforms.conf, line 24: DELIMS (value: ","). Invalid key in stanza [auto_kv_for_microsoft_dhcp] in C:\Program Files\splunkuniversalforwarder\etc\apps\Splunk_TA_windows\default\transforms.conf, line 25: FIELDS (value: msdhcp_id,date,time,description,ip,nt_host,mac ). Invalid key in stanza [msdhcp_signature_lookup] in C:\Program Files\splunkuniversalforwarder\etc\apps\Splunk_TA_windows\default\transforms.conf, line 28: filename (value: msdhcp_signatures.csv). <......SNIP ...> Invalid key in stanza [dns_recordclass_lookup] in C:\Program Files\splunkuniversalforwarder\etc\apps\Splunk_TA_windows\default\transforms.conf, line 1267: filename (value: dns_recordclass_lookup.csv). Invalid key in stanza [geo_us_states] in C:\Program Files\splunkuniversalforwarder\etc\apps\search\default\transforms.conf, line 2: external_type (value: geo). Invalid key in stanza [geo_us_states] in C:\Program Files\splunkuniversalforwarder\etc\apps\search\default\transforms.conf, line 3: filename (value: geo_us_states.kmz). Invalid key in stanza [geo_countries] in C:\Program Files\splunkuniversalforwarder\etc\apps\search\default\transforms.conf, line 6: external_type (value: geo). Invalid key in stanza [geo_countries] in C:\Program Files\splunkuniversalforwarder\etc\apps\search\default\transforms.conf, line 7: filename (value: geo_countries.kmz). Invalid key in stanza [geo_attr_us_states] in C:\Program Files\splunkuniversalforwarder\etc\apps\search\default\transforms.conf, line 10: filename (value: geo_attr_us_states.csv). Invalid key in stanza [geo_attr_countries] in C:\Program Files\splunkuniversalforwarder\etc\apps\search\default\transforms.conf, line 13: filename (value: geo_attr_countries.csv). Invalid key in stanza [geo_hex] in C:\Program Files\splunkuniversalforwarder\etc\apps\search\default\transforms.conf, line 16: external_type (value: geo_hex). Looks like there's a syntax error on every line in de default transforms.conf file. Upgraded from Splunk UF 7.3.3 to Splunk UF 7.3.9 - same problem. This is a default Splunk UF install. No other application is deployed to this UF.

Posts	4
Solutions	1
Karma Given	0
Karma Received	2
Member Since	‎06-16-2021

Online Status	Offline
Date Last Visited	‎04-26-2022 07:52 AM

Invalid key in stanza in Splunk_TA_windows version...

Re: Splunk Indexer services admin bundle errors

Re: Invalid key in stanza in Splunk_TA_windows ver...

Re: How can I see the search peer that a forwarder...

Invalid key in stanza in Splunk_TA_windows version...