Getting Data In

"Invalid key in stanza" - transforms.conf

New Member

On a universal forwarder version 7.3.4.
I am seeing the following errors with btool checks during restart:

Invalid key in stanza [force_sourcetype_for_cisco_asa] in /opt/splunkforwarder/etc/apps/Splunk_TA_cisco-asa/default/transforms.conf, line 2: DEST_KEY  (value:  MetaData:Sourcetype).


No spec file for: /opt/splunkforwarder/etc/apps/TA-cisco_acs/local/app.conf

The invalid stanza error occurs for the multiple stanzas of the default transforms.conf for every app installed. The "No spec file" occurs for multiple apps, most often the app.conf file, but a few other .conf files as well.

I compared the keys in the errors to the same keys in another instance that does not give any errors and they match exactly. Would this have anything to do with the fact that this is a universal forwarder being used as a heavy forwarder?

Labels (2)
0 Karma
Get Updates on the Splunk Community!

New Cloud Intrusion Detection System Add-on for Splunk

In July 2022 Splunk released the Cloud IDS add-on which expanded Splunk capabilities in security and data ...

Happy CX Day to our Community Superheroes!

Happy 10th Birthday CX Day!What is CX Day? It’s a global celebration recognizing innovation and success in the ...

Check out This Month’s Brand new Splunk Lantern Articles

Splunk Lantern is a customer success center providing advice from Splunk experts on valuable data insights, ...