I am running Splunk 5. When I restart Splunk, the Cisco Security Suite app is complaining about possible typos in my configuration files and now the app won't run.
I have never edited these files by hand, so I don't think I messed it up by hand. However, I did recently update from Cisco Security Suite 3.0.2 to 3.0.3 and I wonder if something bad happened during the upgrade.
Any ideas how I can recover from this error?
Update: I even tried uninstalling the App and I still get this error afterwards. After I uninstalled the app, I verified that /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite didn't exist, and then reinstalled the app. The same problem still occurs.
[root@host ~]# splunk btool check
Possible typo in stanza [Cisco Security Suite - Overview - Global Security Events Map] in /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/savedsearches.conf, line 7: display.general.enablePreview = true
Possible typo in stanza [Cisco Security Suite - Overview - Global Security Events Map] in /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/savedsearches.conf, line 8: display.general.timeRangePicker.show = true
Possible typo in stanza [Cisco Security Suite - Overview - Security Event Stats by Host] in /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/savedsearches.conf, line 16: display.general.enablePreview = true
Possible typo in stanza [Cisco Security Suite - Overview - Security Event Stats by Host] in /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/savedsearches.conf, line 17: display.general.type = statistics
Possible typo in stanza [Cisco Security Suite - Overview - Security Event Stats by Host] in /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/savedsearches.conf, line 18: display.general.timeRangePicker.show = true
...
... SKIPED MANY LINES
...
Possible typo in stanza [Cisco Security Suite - Overview - Top Threats] in /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/savedsearches.conf, line 83: display.visualizations.chartHeight = 600px
Possible typo in stanza [Cisco Security Suite - Overview - Top Threats] in /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/savedsearches.conf, line 84: display.visualizations.charting.chart = pie
Possible typo in stanza [Cisco Security Suite - Overview - Top Threats] in /opt/splunk/etc/apps/Splunk_CiscoSecuritySuite/default/savedsearches.conf, line 85: display.visualizations.charting.legend.placement = right
[root@host ~]#
... View more