Do it ASAP to save network bandwidth usage, reduce search run time and unwanted i/o on SH which goes towards disk quota limit. ... View more

This is a known bug (SPL-68932) in Splunk 5.0.3. The message is rather harmless, and your _SYSLOG_ROUTING should still works as usual. You can either ignore the message during splunk startup, or by adding the following entries in your transforms.conf to make the message go away: [accepted_keys] is_valid=_SYSLOG_ROUTING More details on this [accepted_keys] stanza here: http://docs.splunk.com/Documentation/Splunk/5.0.3/Admin/Transformsconf Once you have made the above changes and restart splunk, the warning messages should go away. ... View more

I am getting this same error as the original poster, except on a XenApp 5 server (2003 x32). I just downloaded Splunk and all the components, currently running version 5.0.2, build 149561. I have a multikv.conf file on my splunk server. Is there a fix for this? With this problem the app functionality is very degraded. ... View more