I just upgraded from 4.2.4 to 5.0.2 and see this message whenever I start up Splunk
It no longer appears in the default distsearch.conf or distsearch.conf.spec in 5.0.2.
Is that an error or something else replaced it?
Possible typo in stanza [distributedSearch] in /opt/splunk/etc/system/local/distsearch.conf, line 5: removedTimedOutServers = 1
This is not an error and there is no replacement.
In 5.0.2 the distsearch.conf attribute,
"removedTimedOutServers = false" was removed since it is not a valid setting.
While this was listed in previous 4.x distsearch.conf as a default setting that could be configurable, it was not an attribute that was in use.
Its reference was finally removed starting in 5.0.2 under SPL-56966
[distributedSearch]
removedTimedOutServers = false
If you do have "removedTimedOutServers" configured in your local distsearch.conf, this can be safely removed.
I upgraded from 4.x to 5.0.2 and when I create a new search peer this invalid setting is added.