Hey Splunkers, Why am I getting the following error message when running dedicated capture mode for Splunk stream? Followed the instructions outlined here. I'm currently testing dedicated capture mode on Ubuntu instead of RHEL/CentOS. I don't think thats the problem though. Invalid key in stanza [streamfwd] in /opt/splunk/etc/apps/Splunk_TA_stream/local/streamfwd.conf, line 4: dedicatedCaptureMode (value: 1). Did you mean 'duplicatePacketWindow'? Here are my current config files for directory /opt/splunk/etc/apps/Splunk_TA_stream/local# inputs.conf [streamfwd://streamfwd] splunk_stream_app_location = http://localhost:8000/en-us/custom/splunk_app_stream/ stream_forwarder_id = disabled = 0 streamfwd.conf [streamfwd] dedicatedCaptureMode = 1 streamfwdcapture.0.interface = 0000:86:00.1 streamfwd.xml.bak <InterfaceRegex>enp134s0f1</InterfaceRegex> <Offline>false</Offline> Here is the output from the debug using btool: sudo ./splunk btool check --debug Checking: /opt/splunk/etc/users/admin/search/local/ui-prefs.conf Checking: /opt/splunk/etc/users/admin/search/local/ui-tour.conf Checking: /opt/splunk/etc/users/admin/splunk_app_stream/local/ui-prefs.conf Checking: /opt/splunk/etc/users/admin/user-prefs/local/user-prefs.conf Checking: /opt/splunk/etc/apps/Splunk_TA_bro/local/inputs.conf Checking: /opt/splunk/etc/apps/Splunk_TA_stream/local/inputs.conf Checking: /opt/splunk/etc/apps/Splunk_TA_stream/local/streamfwd.conf Invalid key in stanza [streamfwd] in /opt/splunk/etc/apps/Splunk_TA_stream/local/streamfwd.conf, line 2: dedicatedCaptureMode (value: 1). Did you mean 'duplicatePacketWindow'? Checking: /opt/splunk/etc/apps/learned/local/props.conf Checking: /opt/splunk/etc/apps/splunk_httpinput/local/inputs.conf Checking: /opt/splunk/etc/apps/splunk_instrumentation/local/telemetry.conf Checking: /opt/splunk/etc/apps/SplunkForwarder/default/app.conf Checking: /opt/splunk/etc/apps/SplunkForwarder/default/default-mode.conf Checking: /opt/splunk/etc/apps/SplunkForwarder/default/outputs.conf Checking: /opt/splunk/etc/apps/SplunkForwarder/default/server.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/app.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/default-mode.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/indexes.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/inputs.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/limits.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/outputs.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/props.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/server.conf Checking: /opt/splunk/etc/apps/SplunkLightForwarder/default/web.conf Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/app.conf Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/commands.conf No spec file for: /opt/splunk/etc/apps/Splunk_TA_bro/default/eventgen.conf Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/eventtypes.conf Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/indexes.conf Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/inputs.conf Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/props.conf Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/tags.conf Checking: /opt/splunk/etc/apps/Splunk_TA_bro/default/transforms.conf Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/app.conf Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/distsearch.conf No spec file for: /opt/splunk/etc/apps/Splunk_TA_stream/default/eventgen.conf Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/eventtypes.conf Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/inputs.conf Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/outputs.conf Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/props.conf Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/server.conf Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/streamfwd.conf No spec file for: /opt/splunk/etc/apps/Splunk_TA_stream/default/streamfwdlog.conf Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/tags.conf Checking: /opt/splunk/etc/apps/Splunk_TA_stream/default/transforms.conf Checking: /opt/splunk/etc/apps/alert_logevent/default/alert_actions.conf Checking: /opt/splunk/etc/apps/alert_logevent/default/app.conf Checking: /opt/splunk/etc/apps/alert_logevent/default/restmap.conf Checking: /opt/splunk/etc/apps/alert_webhook/default/alert_actions.conf Checking: /opt/splunk/etc/apps/alert_webhook/default/app.conf Checking: /opt/splunk/etc/apps/alert_webhook/default/restmap.conf Checking: /opt/splunk/etc/apps/appsbrowser/default/app.conf Checking: /opt/splunk/etc/apps/gettingstarted/default/app.conf Checking: /opt/splunk/etc/apps/introspection_generator_addon/default/app.conf Checking: /opt/splunk/etc/apps/introspection_generator_addon/default/inputs.conf Checking: /opt/splunk/etc/apps/introspection_generator_addon/default/server.conf Checking: /opt/splunk/etc/apps/launcher/default/app.conf Checking: /opt/splunk/etc/apps/launcher/default/launcher.conf Checking: /opt/splunk/etc/apps/legacy/default/app.conf Checking: /opt/splunk/etc/apps/legacy/default/props.conf Checking: /opt/splunk/etc/apps/sample_app/default/app.conf Checking: /opt/splunk/etc/apps/sample_app/default/indexes.conf Checking: /opt/splunk/etc/apps/sample_app/default/inputs.conf Checking: /opt/splunk/etc/apps/sample_app/default/props.conf Checking: /opt/splunk/etc/apps/search/default/app.conf Checking: /opt/splunk/etc/apps/search/default/commands.conf Checking: /opt/splunk/etc/apps/search/default/event_renderers.conf Checking: /opt/splunk/etc/apps/search/default/macros.conf Checking: /opt/splunk/etc/apps/search/default/props.conf Checking: /opt/splunk/etc/apps/search/default/restmap.conf Checking: /opt/splunk/etc/apps/search/default/savedsearches.conf Checking: /opt/splunk/etc/apps/search/default/transforms.conf Checking: /opt/splunk/etc/apps/splunk_app_stream/default/app.conf No spec file for: /opt/splunk/etc/apps/splunk_app_stream/default/cloud.conf Checking: /opt/splunk/etc/apps/splunk_app_stream/default/collections.conf Checking: /opt/splunk/etc/apps/splunk_app_stream/default/distsearch.conf Checking: /opt/splunk/etc/apps/splunk_app_stream/default/eventtypes.conf Checking: /opt/splunk/etc/apps/splunk_app_stream/default/inputs.conf Checking: /opt/splunk/etc/apps/splunk_app_stream/default/macros.conf Checking: /opt/splunk/etc/apps/splunk_app_stream/default/restmap.conf Checking: /opt/splunk/etc/apps/splunk_app_stream/default/savedsearches.conf Checking: /opt/splunk/etc/apps/splunk_app_stream/default/times.conf Checking: /opt/splunk/etc/apps/splunk_app_stream/default/ui-tour.conf Checking: /opt/splunk/etc/apps/splunk_app_stream/default/web.conf Checking: /opt/splunk/etc/apps/splunk_app_stream/default/workflow_actions.conf Checking: /opt/splunk/etc/apps/splunk_archiver/default/app.conf Checking: /opt/splunk/etc/apps/splunk_archiver/default/commands.conf Checking: /opt/splunk/etc/apps/splunk_archiver/default/distsearch.conf Checking: /opt/splunk/etc/apps/splunk_archiver/default/props.conf Checking: /opt/splunk/etc/apps/splunk_archiver/default/savedsearches.conf Checking: /opt/splunk/etc/apps/splunk_httpinput/default/inputs.conf Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/alert_actions.conf Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/app.conf Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/collections.conf Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/commands.conf Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/inputs.conf Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/macros.conf Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/props.conf Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/restmap.conf Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/savedsearches.conf Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/telemetry.conf Checking: /opt/splunk/etc/apps/splunk_instrumentation/default/web.conf Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/app.conf Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/checklist.conf Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/distsearch.conf Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/dmc_alerts.conf Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/inputs.conf Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/macros.conf Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/props.conf Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/savedsearches.conf Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/splunk_monitoring_console_assets.conf Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/transforms.conf Checking: /opt/splunk/etc/apps/splunk_monitoring_console/default/visualizations.conf Checking: /opt/splunk/etc/apps/user-prefs/default/app.conf Checking: /opt/splunk/etc/apps/user-prefs/default/user-prefs.conf Checking: /opt/splunk/etc/master-apps/_cluster/default/indexes.conf Checking: /opt/splunk/etc/system/default/alert_actions.conf Checking: /opt/splunk/etc/system/default/app.conf Checking: /opt/splunk/etc/system/default/audit.conf Checking: /opt/splunk/etc/system/default/authentication.conf Checking: /opt/splunk/etc/system/default/authorize.conf Checking: /opt/splunk/etc/system/default/collections.conf Checking: /opt/splunk/etc/system/default/commands.conf No spec file for: /opt/splunk/etc/system/default/conf.conf Checking: /opt/splunk/etc/system/default/datamodels.conf Checking: /opt/splunk/etc/system/default/datatypesbnf.conf Checking: /opt/splunk/etc/system/default/default-mode.conf Checking: /opt/splunk/etc/system/default/distsearch.conf Checking: /opt/splunk/etc/system/default/event_renderers.conf Checking: /opt/splunk/etc/system/default/eventdiscoverer.conf Checking: /opt/splunk/etc/system/default/eventtypes.conf Checking: /opt/splunk/etc/system/default/fields.conf Checking: /opt/splunk/etc/system/default/health.conf Checking: /opt/splunk/etc/system/default/indexes.conf Checking: /opt/splunk/etc/system/default/inputs.conf Checking: /opt/splunk/etc/system/default/limits.conf Checking: /opt/splunk/etc/system/default/livetail.conf Checking: /opt/splunk/etc/system/default/messages.conf Checking: /opt/splunk/etc/system/default/multikv.conf Checking: /opt/splunk/etc/system/default/outputs.conf Checking: /opt/splunk/etc/system/default/procmon-filters.conf Checking: /opt/splunk/etc/system/default/props.conf Checking: /opt/splunk/etc/system/default/restmap.conf Checking: /opt/splunk/etc/system/default/savedsearches.conf Checking: /opt/splunk/etc/system/default/segmenters.conf Checking: /opt/splunk/etc/system/default/server.conf Checking: /opt/splunk/etc/system/default/serverclass.conf Checking: /opt/splunk/etc/system/default/source-classifier.conf Checking: /opt/splunk/etc/system/default/telemetry.conf Checking: /opt/splunk/etc/system/default/times.conf Checking: /opt/splunk/etc/system/default/transactiontypes.conf Checking: /opt/splunk/etc/system/default/transforms.conf Checking: /opt/splunk/etc/system/default/ui-prefs.conf Checking: /opt/splunk/etc/system/default/ui-tour.conf Checking: /opt/splunk/etc/system/default/viewstates.conf Checking: /opt/splunk/etc/system/default/visualizations.conf Checking: /opt/splunk/etc/system/default/web.conf Checking: /opt/splunk/etc/system/default/workflow_actions.conf Checking: /opt/splunk/etc/system/local/inputs.conf No spec file for: /opt/splunk/etc/system/local/migration.conf Checking: /opt/splunk/etc/system/local/server.conf ... View more