On a universal forwarder version 7.3.4.
I am seeing the following errors with btool checks during restart:
Invalid key in stanza [force_sourcetype_for_cisco_asa] in /opt/splunkforwarder/etc/apps/Splunk_TA_cisco-asa/default/transforms.conf, line 2: DEST_KEY (value: MetaData:Sourcetype).
and
No spec file for: /opt/splunkforwarder/etc/apps/TA-cisco_acs/local/app.conf
The invalid stanza error occurs for the multiple stanzas of the default transforms.conf for every app installed. The "No spec file" occurs for multiple apps, most often the app.conf file, but a few other .conf files as well.
I compared the keys in the errors to the same keys in another instance that does not give any errors and they match exactly. Would this have anything to do with the fact that this is a universal forwarder being used as a heavy forwarder?
