topic Re: Splunk Enterprise Security: Invalid Stanza Dev Prod in Splunk Enterprise Security

Splunk Enterprise Security: Invalid Stanza Dev Prod

0xAli — Thu, 06 Aug 2026 13:05:12 GMT

Hi all,

Anyone face the below, and how to get ride of it:

Re: Splunk Enterprise Security: Invalid Stanza Dev Prod

richgalloway — Thu, 06 Aug 2026 14:20:02 GMT

btool will report a "Invalid key" error whenever it finds a key in a .conf file that is not present in the corresponding .spec file. In the case of ES, there is no feature_flags.conf.spec file so everything in feature_flags.conf is treated by btool as something that should not be there.

For now, ignore the messages and consider posting a request on https://ideas.splunk.com

Re: Splunk Enterprise Security: Invalid Stanza Dev Prod

livehybrid — Thu, 06 Aug 2026 14:22:53 GMT

Hi @0xAli

These look like benign errors based on Splunk not adding these flags/stanzas to their feature flag spec file...annoying though - which app version of ES is this?

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful

Marking it as the solution if it resolved your issue

Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

Re: Splunk Enterprise Security: Invalid Stanza Dev Prod

0xAli — Thu, 06 Aug 2026 18:05:56 GMT

We used ES 8.5.1.

Re: Splunk Enterprise Security: Invalid Stanza Dev Prod

0xAli — Thu, 06 Aug 2026 18:07:13 GMT

Ok, thanks!

Will do it.