topic Re: Why am I getting the following error after updating from 6.6.0 to 6.6.3: Invalid key in stanza [auditTrail] in /opt/splunk/etc/system/local/audit.conf in Splunk Search https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343505#M165994 <P>"Block signing" was removed in 6.3 when it was replaced by "data integrity".</P> <P>Even though you may have had config in your audit.conf for keys, I don't think this has been doing anything at all since 6.3.<BR /> It looks like they tidied up the superfluous config between the versions you mention, so on the face of it, the solution is simply to remove those configurations because they have not been used for a few years. </P> <P>Might be worth checking if you enabled DI following Splunk 6.3</P> Wed, 17 Jan 2018 21:27:06 GMT nickhills 2018-01-17T21:27:06Z Why am I getting the following error after updating from 6.6.0 to 6.6.3: Invalid key in stanza [auditTrail] in /opt/splunk/etc/system/local/audit.conf https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343499#M165988 <P>I'm getting this error: Invalid key in stanza [auditTrail] in /opt/splunk/etc/system/local/audit.conf</P> <P>Looking at the audit.conf.spec, that key is no longer mentioned. In earlier versions it was. I couldn't find anything in the release notes about this.</P> Wed, 20 Sep 2017 15:01:10 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343499#M165988 gregbo 2017-09-20T15:01:10Z Re: Why am I getting the following error after updating from 6.6.0 to 6.6.3: Invalid key in stanza [auditTrail] in /opt/splunk/etc/system/local/audit.conf https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343500#M165989 <P>Would you mind sharing the key name?</P> Wed, 20 Sep 2017 17:32:22 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343500#M165989 s2_splunk 2017-09-20T17:32:22Z Re: Why am I getting the following error after updating from 6.6.0 to 6.6.3: Invalid key in stanza [auditTrail] in /opt/splunk/etc/system/local/audit.conf https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343501#M165990 <P>Seems between 6.6.2 and 6.6.3 there were some features changed in the spec file. Im guessing this is around the privatekey and publickey keys in the config file?</P> Wed, 20 Sep 2017 18:04:10 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343501#M165990 esix_splunk 2017-09-20T18:04:10Z Re: Why am I getting the following error after updating from 6.6.0 to 6.6.3: Invalid key in stanza [auditTrail] in /opt/splunk/etc/system/local/audit.conf https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343502#M165991 <P>the privatekey and publickey keys</P> Thu, 21 Sep 2017 09:59:57 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343502#M165991 gregbo 2017-09-21T09:59:57Z Re: Why am I getting the following error after updating from 6.6.0 to 6.6.3: Invalid key in stanza [auditTrail] in /opt/splunk/etc/system/local/audit.conf https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343503#M165992 <P>yep, the privatekey and publickey keys</P> Thu, 21 Sep 2017 10:00:11 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343503#M165992 gregbo 2017-09-21T10:00:11Z Re: Why am I getting the following error after updating from 6.6.0 to 6.6.3: Invalid key in stanza [auditTrail] in /opt/splunk/etc/system/local/audit.conf https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343504#M165993 <P>After our upgrade to 6.6.5 from 6.4.3, I am seeing the same error. Do you know more how to fix this? Thanks.</P> Wed, 17 Jan 2018 20:42:33 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343504#M165993 lqiao 2018-01-17T20:42:33Z Re: Why am I getting the following error after updating from 6.6.0 to 6.6.3: Invalid key in stanza [auditTrail] in /opt/splunk/etc/system/local/audit.conf https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343505#M165994 <P>"Block signing" was removed in 6.3 when it was replaced by "data integrity".</P> <P>Even though you may have had config in your audit.conf for keys, I don't think this has been doing anything at all since 6.3.<BR /> It looks like they tidied up the superfluous config between the versions you mention, so on the face of it, the solution is simply to remove those configurations because they have not been used for a few years. </P> <P>Might be worth checking if you enabled DI following Splunk 6.3</P> Wed, 17 Jan 2018 21:27:06 GMT https://community.splunk.com/t5/Splunk-Search/Why-am-I-getting-the-following-error-after-updating-from-6-6-0/m-p/343505#M165994 nickhills 2018-01-17T21:27:06Z