After we upgraded splunk from 6.4.5 to 6.4.6 we see lot of stanza related errors. Ran "splunk btool check" to generate report. Below are few of 100s of errors:
Invalid key in stanza [CPU Used-Summary] in /opt/splunkforwarder/etc/apps/xxx/default/savedsearches.conf, line 10: dispatch.earliest_time (value: -5m@m).
Invalid key in stanza [CPU Used-Summary] in /opt/splunkforwarder/etc/apps/xxx/default/savedsearches.conf, line 11: dispatch.latest_time (value: -0s@s).
Invalid key in stanza [CPU Used-Summary] in /opt/splunkforwarder/etc/apps/xxx/default/savedsearches.conf, line 12: enableSched (value: 1).
Invalid key in stanza [Disk Used-Summary] in /opt/splunkforwarder/etc/apps/xxx/default/savedsearches.conf, line 23: cron_schedule (value: */30 * * * *).
All these are valid keys in saved searches.conf.
Can you check savedsearches.conf.spec file under $SPLUNK_HOME/etc/system/README/ contains these values like dispatch.latest_time, dispatch.earliest_time, enableSched?