I saw an answer that said this was corrected in 4.2 but I'm seeing this on 6.0.5 universal forwarder. Noticed the spec file has the correct config also so I'm not sure why btool complains about this. What gives?:
Possible typo in stanza [tcp:9999] in /opt/splunkforwarder/6.0.5-214064/etc/apps/mytcp/default/inputs.conf, line 5: connection_host = none
/opt/splunkforwarder/6.0.5-214064/etc/apps/mytcp/default/inputs.conf:
[tcp:9999]
sourcetype = foo
index = foo
queueSize = 1GB
connection_host = none
/opt/splunkforwarder/6.0.5-214064/etc/system/README/inputs.conf.spec:
[tcp://<remote server>:<port>]
* Configure Splunk to listen on a specific port.
* If a connection is made from <remote server>, this stanza is used to configure the input.
* If <remote server> is empty, this stanza matches all connections on the specified port.
* Will generate events with source set to tcp:portnumber, for example: tcp:514
* If sourcetype is unspecified, will generate events with set sourcetype to tcp-raw.
# Additional attributes:
connection_host = [ip|dns|none]
* "ip" sets the host to the IP address of the system sending the data.
* "dns" sets the host to the reverse DNS entry for IP address of the system sending the data.
* "none" leaves the host as specified in inputs.conf, typically the splunk system hostname.
* Defaults to "dns".
queueSize = <integer>[KB|MB|GB]
* Maximum size of the in-memory input queue.
* Defaults to 500KB.
... View more