Quantcast
Channel: Questions in topic: "upgrade"
Viewing all articles
Browse latest Browse all 457

Getting "Invalid key in stanza" error after upgrading Splunk forwarder to 6.4.1

$
0
0
Hi, I have upgraded a Splunk forwarder to 6.4.1 and after the upgrade, when I run `/splunkforwarder/bin/splunk btool check` command, I get lots of invalid key in stanza errors in savedsearches.conf file as below. /splunkforwarder/bin/splunk btool check Invalid key in stanza [Percent CPU by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 9: search (value: `Percent_CPU_by_Host(*)`). Invalid key in stanza [Percent CPU by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 10: action.email.sendresults (value: 0). Invalid key in stanza [Percent CPU by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 11: dispatch.earliest_time (value: -1h). Invalid key in stanza [Percent CPU by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 12: dispatch.latest_time (value: +0s). Invalid key in stanza [Percent CPU by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 13: dispatch.ttl (value: 3600). Invalid key in stanza [Percent CPU by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 14: displayview (value: report_builder_display). Invalid key in stanza [Percent Load by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 17: search (value: `Percent_Load_by_Host(*)`). Invalid key in stanza [Percent Load by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 18: action.email.sendresults (value: 0). Invalid key in stanza [Percent Load by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 19: dispatch.earliest_time (value: -1h). Invalid key in stanza [Percent Load by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 20: dispatch.latest_time (value: +0s). Invalid key in stanza [Percent Load by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 21: dispatch.ttl (value: 3600). Invalid key in stanza [Percent Load by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 22: displayview (value: report_builder_display). Invalid key in stanza [Top 5 CPU Processes by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 25: search (value: `Top_5_CPU_Processes_by_Host(*)`). Invalid key in stanza [Top 5 CPU Processes by Host (UNIX - CPU)] in /splunkforwarder/etc/apps/unix/default/savedsearches.conf, line 26: action.email.sendresults (value: 0). What could be the problem here?

Viewing all articles
Browse latest Browse all 457

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>