Index was not created automatically too Sample. I have nf file works on my local as follow, however it didnt works on other environment (i.e. conf files other than nf – no such errors for nf. Hi Experts, I dont want to wake up any zombies, hence I create new thread here. We also have hundreds of errors for “No spec file for:” for all. The common mistake is not doing this on the UF. I have seen woodcock resolve some other examples and I cant quite see where Im going wrong. conf files and Splunk is reporting that fields such as index, source, sourcetype, crcSalt, initCrcLength and more are invalid stanzas. Im ingesting logs from DNS (Next DNS via API) and struggling to exclude the header. When I run a btool check against all of our. We have hundreds of such ‘invalid key’ errors. I cant find an appropriate file where the issue could be fixed, but maybe I am not looking in correct place. by Kieffer87 on 02-14-2017 10:53 AM Latest post on 02-14-2017 08:12 PM by dwaddle.

conf files and Splunk is reporting that fields such as index, source, sourcetype, crcSalt, initCrcLength and more are invalid stanzas. I can't find an appropriate file where the issue could be fixed, but maybe I am not looking in correct place. I don't understand why Splunk doesn't like these lines. each path has around 1250 files, so i should find around 2500 files when searching for files. ' which complains about a line where I have please need your support as SPLUNK didnt parse all files from same path, i.e for example in my nf there are 2 stanza to monitor two paths. For more information about editing the nf file, see. If your file is smaller than 10000 bytes Splunk will report the message you see and re-index the file. Restart the Splunk Universal Forwarder service for the changes to take effect. On my deployment server, when running btool check against nf and 'grep'ing for the name of my manually created app (which has nothing but a local directory, an nf and an automatically created app.conf file) I have a 'Invalid key in stanza. Your nf setting of initCrcLength 10000 tells Splunk to read 10000 bytes into the file to validate the seekcrc or if this file was seen before.

Initcrclength splunk inputs.conf