Error: "Configuration file settings may be duplicated in multiple apps" when creating a saved search

Applicability

Description

When creating saved searches, it is possible to inadvertently create two or more searches with the exact same name in different apps. Once the saved search runs, it triggers the following warning on the Messages tab.

Configuration file settings may be duplicated in multiple apps: stanza="MyAlertName" 
conf_type="savedsearches" apps="search,search" ‎11‎/‎15‎/‎2018‎ ‎2‎:‎33‎:‎34‎ ‎PM

Investigation

To locate the saved search triggering the WARN message perform the following steps:

1. Run the following search to identify the affected saved search stanza and the apps where the configuration exists:

index=_internal sourcetype=configuration_check "*Configuration file settings may be duplicate*" 
| rex field=_raw "stanza=\"(?<stanza>[^\"]+)\"" 
| rex field=message "^(?<error_message>[^:]+)" 
| dedup stanza 
| table _time apps conf_type stanza error_message

     2. Run the following search query to review the location of the reported stanza. Replace "Affected stanza" with the name of the affected saved search to review specific searches:

| rest /servicesNS/-/-/saved/searches | search title="Affected stanza"
| table title, eai:acl.app, eai:acl.owner, search

     3. Run the following search query to review the location of the reported stanza and display all the searches mentioned in the WARN message:

index=_internal sourcetype=configuration_check "*Configuration file settings may be duplicate*" 
| rex field=_raw "stanza=\"(?<stanza>[^\"]+)\"" 
| rex field=message "^(?<error_message>[^:]+)" 
| dedup stanza 
| eval principal_error_message = replace(error_message, "settings", "settings [" . stanza . "]") . "; " . apps 
| join max=0 stanza 
    [| rest /servicesNS/-/-/saved/searches 
    | rename title AS stanza 
    | fields stanza, eai:acl.app, eai:acl.owner, search
        ] 
| rename stanza AS stanza_ eai:acl.app as app eai:acl.owner as owner 
| stats count by principal_error_message, stanza_, app, owner, search

     4. Alternatively, to locate the saved search that triggers the warning message via the CLI, run the following command to find the affected search:

find $SPLUNK_HOME/etc/ -name "savedsearches.conf" | xargs grep "\[MyAlertName\]"

Resolution

For Splunk Enterprise Security 10.4, and 10.5: If the warning message is reporting the stanzas s2modecheck, getMetricTransformsList, getIndexesListWithFederated, getIndexesList, or _private_splunk_getCloudIndexesInfo across the cloud_administration and 100-app-manager apps, this message is safe to ignore., since this is a known issue that will be fixed in a future release.

For user-created saved searches: Once the duplicated alerts, reports, or saved searches are found, perform the following actions to resolve the issue:

• Rename the saved search, alert, or report to a unique name.
• Alternatively, remove or comment out one of the duplicated items and all of its attributes within the savedsearches.conf file.
• Restart the Splunk service to apply the changes.

Note:

The stanza name for alerts, reports, and saved searches must be unique to avoid name conflicts. 

Related Links

Configuration file settings may be duplicated in multiple apps