Errors After Upgrading Splunk from 9.1.1 to Latest Version

[BRFZ]

Hi Splunk Community,

I recently upgraded my Splunk environment from version 9.1.1 to the latest version. After the upgrade, I’m encountering errors when trying to restart Splunk across different components.

For example, I get the following error:

Invalid key in stanza [default] in /opt/splunk/etc/system/local/indexes.conf, line 132: archiver.enableDataArchive (value: false)

It seems like some configuration keys are no longer valid in the updated version. Has anyone faced similar issues, and how can I resolve these errors to ensure my configurations are compatible with the latest Splunk version?

Thanks in advance for your help!

Best regards,

[richgalloway · Accepted solution]

That setting is for Splunk Cloud only.  Remove it from your config.