Splunk crashes when i restart, have to rename config files

[ductom2002]

Splunk crashes after restart. If i rename the config files its starts without a problem.

Version is 5.01

My configs:

input.conf

[monitor:///mnt/netapp/vol0_filer0/etc/log]
disabled = false
followTail = 0
host_segment = 3
index = netapp
blacklist = (stats)|(/mlog/.last_rotate)|(/log/autosupport)

[monitor:///mnt/netapp/vol0_filer1/etc/log]
disabled = false
followTail = 0
host_segment = 3
index = netapp
blacklist = (stats)|(/mlog/.last_rotate)|(/log/autosupport)

[script://$SPLUNK_HOME/etc/apps/SplunkAppforNetApp/bin/SNap.py -h 01]
disabled = 0
interval = 500
sourcetype = netapp:internal
index = netapp

snap_hosts.csv

10.2.X.X, user_api, somepass
10.2.X.X, user_api, somepass

[ductom2002]

@piebob

Sure, i'd edit inputs.conf (just a typo 😉

[halr9000]

The third stanza "script://$SPLUNK_HOME/etc/apps/SplunkAppforNetApp/bin/SNap.py -h 01" is not necessary unless you are intentionally wanting to gather multiple sets of stats from different filers. The scripted input in default/inputs.conf (looks similar minus the "-h 01" portion) is all that you need in most cases. At the very least, remove this last stanza and see how that goes.

Adding the H parameter (which we haven't documented yet) requires that you create additional csv files for telling it what you want counters to grab. If that file is missing, I suppose it could cause the python script to throw an exception. That shouldn't crash Splunk, though.

[halr9000]

note that we converted your review to a question so that we can interact and points can be awarded, and so on. thanks!

[piebob]

what config files are you renaming?
the inputs.conf file should be called inputs.conf, not input.conf, is this the problem?