Archive
Highlighted

Splunk errors "Invalid key in stanza" after upgrading to 6.4.6

New Member

After we upgraded splunk from 6.4.5 to 6.4.6 we see lot of stanza related errors. Ran "splunk btool check" to generate report. Below are few of 100s of errors:

    Invalid key in stanza [CPU Used-Summary] in /opt/splunkforwarder/etc/apps/xxx/default/savedsearches.conf, line 10: dispatch.earliest_time  (value:  -5m@m).
    Invalid key in stanza [CPU Used-Summary] in /opt/splunkforwarder/etc/apps/xxx/default/savedsearches.conf, line 11: dispatch.latest_time  (value:  -0s@s).
    Invalid key in stanza [CPU Used-Summary] in /opt/splunkforwarder/etc/apps/xxx/default/savedsearches.conf, line 12: enableSched  (value:  1).
            Invalid key in stanza [Disk Used-Summary] in /opt/splunkforwarder/etc/apps/xxx/default/savedsearches.conf, line 23: cron_schedule  (value:  */30 * * * *).
Tags (1)
0 Karma
Highlighted

Re: Splunk errors "Invalid key in stanza" after upgrading to 6.4.6

Motivator

All these are valid keys in saved searches.conf.

Can you check savedsearches.conf.spec file under $SPLUNKHOME/etc/system/README/ contains these values like dispatch.latesttime, dispatch.earliest_time, enableSched?

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.