Invalid key in stanza [http] in /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf

Applicability

Description

1. Heavy forwarders are connected to the deployment server.

2. Configured HEC token in the HTTP Event Collector and created new HEC token inputs in the GUI on the deployment server. In HTTP Event Collector, Global Settings -> Use Deployment Server selected and Save.

Note: Enabling the deployment server flag made the rcvbuf = 1572863 in the [http] stanza.

3. And created an HEC token, Name: test1, Enabled indexer acknowledgment, left source type and index as default and saved.

Navigate to $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf

[http]
ackIdleCleanup = true
allowSslCompression = true
allowSslRenegotiation = true
dedicatedIoThreads = 2
disabled = 1
enableSSL = 1
index = default
maxSockets = 0
maxThreads = 0
port = 8088
sslVersions = *,-ssl2
_rcvbuf = 1572864
rollingRestartReturnServerBusy = true[http://test1]
disabled = 0
host = i-0103f70173e10a266.ec2.splunkit.io
token = 5032259d-b49e-4856-889b-3f13d280637a
useACK = 1

 
4.  Post that deploys app splunk_httpinput to deployment client (HFs).

Investigation

1. If we perform a restart on the HF, we get the below error related to the _rcvbuf parameter,

Checking conf files for problems...
                Invalid key in stanza [http] in /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf, line 13: _rcvbuf (value: 1572864).

2. When we run the Splunk btool check command get the same error,

./splunk btool check
                Invalid key in stanza [http] in /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf, line 13: _rcvbuf (value: 1572864).

3. It seems this _rcvbuf parameter is unnecessary for the [http] stanza, checked in the input.conf specs document.

Resolution

1. Regarding the behavior of this Deployment Server" flag in HTTP Event Collector it was verified that the issue is not with the Deployment server upgrade,  It is related to some conf handling.
2. Navigate to $SPLUNK_HOME/etc/apps/splunk_httpinput/local/inputs.conf
   Remove this unnecessary parameter "rcvbuf = 1572864" under [http] stanza in inputs.conf.
   
   

   [http]
   ackIdleCleanup = true
   allowSslCompression = true
   allowSslRenegotiation = true
   dedicatedIoThreads = 2
   disabled = 1
   enableSSL = 1
   index = default
   maxSockets = 0
   maxThreads = 0
   port = 8088
   sslVersions = *,-ssl2
   rollingRestartReturnServerBusy = true

2.  Perform a Splunk restart.

Note: This a minor issue that is currently having no impact, this will be addressed in future releases.