Splunk Enterprise

After a successful upgrade from 6.2.1 to 6.6.1, we are getting Invalid value in stanza when splunk is rebooted?

Hemnaath
Motivator

Hi All, Currently we have moved from older splunk version to latest version, but when we reboot the splunk services, we found it is throwing some invalid key stanza details, but not sure what exactly we need to do to fix this issue.

Checking conf files for problems...
Invalid key in stanza [serverClass:All_search_heads] in /opt/splunk/etc/apps/search/local/serverclass.conf, line 34: targetRepositoryLocation (value: "/splunk_search_pool/etc/apps").

Invalid key in stanza [tcpout:all_indexers] in /opt/splunk/etc/apps/All_fwd_outputs/default/outputs.conf, line 7: autoLB (value: true).

Invalid key in stanza [sys_activated] in /opt/splunk/etc/apps/security/default/eventtypes.conf, line 2: index (value: n_fw sourcetype=syslog "Input/CMD1" OR edsnotifier activated OR fwrules/active).

Invalid key in stanza [email] in /opt/splunk/etc/system/local/alert_actions.conf, line 5: reportServerEnabled (value: 0).
Invalid key in stanza [email] in /opt/splunk/etc/system/local/alert_actions.conf, line 6: reportServerURL (value: ).

Kindly guide me how to fix the issue.

Tags (1)
0 Karma
1 Solution

jplumsdaine22
Influencer

The Invalid Key error means that key in the stanza is not recognised by splunk as belonging in that conf file. Its possible your old config files contain removed keys - check the relevant documentation in previous versions to see what they have been replaced with. (Usually when the keys are deprecated Splunk will indicate in the docs what they have been replaced with)

Also check that there are no typos in the keys!

View solution in original post

0 Karma

googs524
Explorer

As far as the autoLB error is concerned, "autoLB=true" setting is invalid from splunk 6.6. As autoLB is only configured as true (you can't make it false), no need to mention the setting explicitly from Splunk 6.6 and autolb is by default enabled.

0 Karma

jplumsdaine22
Influencer

The Invalid Key error means that key in the stanza is not recognised by splunk as belonging in that conf file. Its possible your old config files contain removed keys - check the relevant documentation in previous versions to see what they have been replaced with. (Usually when the keys are deprecated Splunk will indicate in the docs what they have been replaced with)

Also check that there are no typos in the keys!

0 Karma

Hemnaath
Motivator

Hi jplumsdaine, thanks for your effort on this, Yes I had removed the stanza that was showing the Invalid Key error. After deleting the stanza from the configuration files and bounced the splunk service and found no errors were popping out.

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...