Splunk Enterprise Security: Invalid Stanza Dev Prod

[0xAli]

Hi all,

Anyone face the below, and how to get ride of it:

[livehybrid]

Hi @0xAli 

These look like benign errors based on Splunk not adding these flags/stanzas to their feature flag spec file...annoying though - which app version of ES is this?

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.

[0xAli]

We used ES 8.5.1.

[richgalloway · Accepted solution]

btool will report a "Invalid key" error whenever it finds a key in a .conf file that is not present in the corresponding .spec file.  In the case of ES, there is no feature_flags.conf.spec file so everything in feature_flags.conf is treated by btool as something that should not be there.

For now, ignore the messages and consider posting a request on https://ideas.splunk.com

[0xAli]

Ok, thanks!

Will do it.