ERROR: "Invalid key in stanza" when restarting Splunk process.

Available Languages

Updated:September 28, 2026
Document ID:SPLK044435

Bias-Free Language

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Applicability

Splunk Cloud Splunk Enterprise

Description

After setting a new property within a configuration file and restart the Splunk instance, the following message is shown when using the health check
  
Invalid key in stanza [search] in /opt/splunk/etc/system/local/limits.conf, line 11: enable_conditional_expansion (value: false).


 

Investigation

The consistency within the configuration files can be checked using btool 
./splunk btool check –debug

A list of all configuration files can be found in the left side of this page https://docs.splunk.com/Documentation/Splunk/8.0.0/Admin/Savedsearchesconf

The "Invalid key in stanza"  error is raised when there is an inconsistency between a .conf file and its .spec file. This usually happens in these type of scenarios:
 
  • There is a typo in the key or the stanza,
  • The key is not set in the right stanza,
  • It is a hidden property, provided by Splunk Support of Proffesional Services in order to debug any issue. Those properties are not public and hence they are not in the .spec file

In the example provided in this KB, enable_conditional_expansion is a hidden property within limits.conf. These kind of properties only have to be used when Splunk Support requests it, and only for troubleshooting purposes.

Resolution

If the property is public, look for any typos or check it is in the right position within the .conf file. Check the .spec file if necessary (i.e. for the limits.conf file, there is the limits.conf.spec with the right structure)

If it is a hidden property this error can safely be ignored. Even when the stanza error is shown, the property will work if it is in the right position within the .conf file. Ask Support about that if necessary. 
Splunk Documentation

List of configuration files

Revision History

Revision Publish Date Comments
1.0
28-Sep-2026
Initial Release

Was this Document Helpful?

FeedbackFeedback

Contact Cisco

This Document Applies to These Products