We keep getting warnings such as
We have gone into the savedsaerch conf files and renames them on a diferent SH but I dont think thats the answer.
So my question is what is the answer?
Hi @domino30,
Splunk manages configurations conflicts between conf files from different apps, but it doesn't accept duplicated configurations in the same app or conf file.
In your case, in the Splunk_SA_CIM_search app, you have two stanzas with the same name, you have to manually remove one of them.
Ciao.
Giuseppe