Doing some Splunk Maintainance today, working through issues. This is one that has me stumped. Comes up when I restart splunk. Splunk is still running though.
Can anyone help me on the location of this error, so I can fix it?
I'd start by using the find command to see if the reported string is in any of your props.conf files.
find /opt/splunk/etc -name props.conf -print0 | xargs -r0 grep "\(::)\?"
When you find that you should know what needs fixing.