This morning I logged into our deployment server and found a message that the forwarder manager screen was in 'read only' mode because some of our serverclass.conf settings were not supported.
Ok, not a big deal, right? I figured I would just browse the config, find the error and correct it.
The error message that was thrown is below:
11-16-2015 12:08:18.789 -0500 WARN DS_DC_Common - Attribute unsupported by UI: stanza=serverClass:PerfmonManage property=restartSplunkd reason='2+ distinct values at this level'
Well, the problem is that my D:\Program Files\Splunk\etc\system\local\serverclass.conf doesn't contain any stanza named "serverClass:PerfmonManage"
Is there an easy way to figure out where Splunk has picked up "serverClass:PerfmonManage", maybe in another conf that I'm not thinking of?
Use btool to see the config...
./splunk cmd btool serverclass list --debug
then track down the serverclass in question with the merged btool output.
View solution in original post
Ah, btool, I thought that might be the right direction. I'll take a look. Thanks!