On a universal forwarder version 7.3.4.
I am seeing the following errors with btool checks during restart:
Invalid key in stanza [force_sourcetype_for_cisco_asa] in /opt/splunkforwarder/etc/apps/Splunk_TA_cisco-asa/default/transforms.conf, line 2: DEST_KEY (value: MetaData:Sourcetype).
and
No spec file for: /opt/splunkforwarder/etc/apps/TA-cisco_acs/local/app.conf
The invalid stanza error occurs for the multiple stanzas of the default `transforms.conf` for every app installed. The "No spec file" occurs for multiple apps, most often the `app.conf` file, but a few other `.conf` files as well.
I compared the keys in the errors to the same keys in another instance that does not give any errors and they match exactly. Would this have anything to do with the fact that this is a universal forwarder being used as a heavy forwarder?
↧