Hi,
I have upgraded a Splunk forwarder to 6.4.1 and after the upgrade, when I run `/splunkforwarder/bin/splunk btool check` command, I get lots of invalid key in stanza errors in savedsearches.conf file as below.
/splunkforwarder/bin/splunk btool check
Invalid key in stanza [Percent CPU by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 9: search (value: `Percent_CPU_by_Host(*)`).
Invalid key in stanza [Percent CPU by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 10: action.email.sendresults (value: 0).
Invalid key in stanza [Percent CPU by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 11: dispatch.earliest_time (value: -1h).
Invalid key in stanza [Percent CPU by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 12: dispatch.latest_time (value: +0s).
Invalid key in stanza [Percent CPU by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 13: dispatch.ttl (value: 3600).
Invalid key in stanza [Percent CPU by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 14: displayview (value: report_builder_display).
Invalid key in stanza [Percent Load by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 17: search (value: `Percent_Load_by_Host(*)`).
Invalid key in stanza [Percent Load by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 18: action.email.sendresults (value: 0).
Invalid key in stanza [Percent Load by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 19: dispatch.earliest_time (value: -1h).
Invalid key in stanza [Percent Load by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 20: dispatch.latest_time (value: +0s).
Invalid key in stanza [Percent Load by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 21: dispatch.ttl (value: 3600).
Invalid key in stanza [Percent Load by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 22: displayview (value: report_builder_display).
Invalid key in stanza [Top 5 CPU Processes by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 25: search (value: `Top_5_CPU_Processes_by_Host(*)`).
Invalid key in stanza [Top 5 CPU Processes by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 26: action.email.sendresults (value: 0).
What could be the problem here?
↧