Invalid key in stanza [webhook]   This is a bug in 9.0.0 Updating should get rid of it. If you want to remove the message without updating, you can edit    /opt/splunkforwarder/etc/system/default/alert_actions.conf   and remove the line 229 : enable_allowlist = false But this will have a impact on the manifest check at start, as you're not supposed to edit files provided with the installation.   You could also edit the manifest file and remove the line which checks for this specific aler_actions.conf, but splunk support may ask for the original manifest file if you open a case with them.     About  Warning: Attempting to revert the SPLUNK_HOME ownership Warning: Executing "chown -R splunk /opt/splunkforward This is a automatic message since version 9 everytime you type a splunk command line. At this time the correct procedure to get rid of this is not clearly defined, as far as I know.   ... View more