Hi dmuruganantham, I think this is expected behavior. We just upgraded our environments (7.3.5 --> 8.1.3) and are now seeing these messages/notifications. Check to see if you have "lockRoleToFullDN=true" set in authentication.conf: splunk/bin/splunk btool authentication list --debug | grep lockRoleToFullDN When this parameter is set to true Splunk will capture the full DN of a CN, the first time it sees it, and insert it under the [lockedRoleToFullDNMap_SAML] stanza in etc/system/local/authentication.conf. I believe you can disable these notifications by setting "lockRoleToFullDN=false". However, I have not tested this just yet. See documentation here for reference: https://docs.splunk.com/Documentation/Splunk/8.1.3/Admin/Authenticationconf#Security_Assertion_Markup_Language_.28SAML.29_settings   Regards, ... View more

I'm right there with you Bryan... To get past this I searched through all the SA's and TA's looking at the inputs.conf.spec files. I found that the stanza Splunk_TA_vmware was expecting lives in the SA-VMNetAppUtils inputs.conf.spec file (SA-VMNetAppUtils/README/inputs.conf.spec). I copied the necessary stanza from there, made a backup copy of the inputs.conf.spec file in Splunk_TA_vmware, and then pasted the missing stanza into the inputs spec file. From there I ran my cluster bundle apply and saw no errors. For reference, here is the missing stanza: `[dm_accel_settings://default] * Configure an input for enforcing data model acceleration settings automatically * when another app is installed. Note that only one app at a time should define * the acceleration settings for a given data model. Usually this is the "primary" * app for the suite of apps on the system, e.g. SplunkEnterpriseSecuritySuite. acceleration = [true|false] * True if the data model should be accelerated. manual_rebuilds = [true|false] * If true, changes to the datamodel will not automatically rebuild the HPAS * data store.` ... View more