Invalid key in stanza .. in props.conf

PavelP — Sat, 31 Aug 2019 11:59:36 GMT

to make the configuration more readable I use "\" to break long lines, which works fine:

EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  , \
                   FOO="Command" && BAR="test2"                             , var1  , \
                   FOO="Command" && BAR="test4"                             , var1  , \
                   FOO="Command" && BAR="test6"                             , var1  , \
                   FOO="Command" && BAR="test7"                             , var1  , \
                   FOO="Command" && BAR="test8"                             , var1  )

As soon as the lines get more complex I get "Invalid key in stanza" error:

EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  , \
                   FOO="Command" && BAR="test2"                             , var1  , \
                   FOO="Command" && BAR="test3" && match ( var2, "abc.*" )  , var2  , \
                   FOO="Command" && BAR="test4"                             , var1  , \
                   FOO="Command" && BAR="test5" && match ( var2, "xyz.*" )  , var2  , \
                   FOO="Command" && BAR="test6"                             , var1  , \
                   FOO="Command" && BAR="test7"                             , var1  , \
                   FOO="Command" && BAR="test8"                             , var1  )

$ splunk btool --app=PropsProblem props list
[test2]
EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  ,
                   FOO="Command" && BAR="test2"                             , var1  ,
                   FOO="Command" && BAR="test3" && match ( var2, "abc.*" )  , var2  , \
FOO = "Command" && BAR="test6"                             , var1  ,
                   FOO="Command" && BAR="test7"                             , var1  ,
                   FOO="Command" && BAR="test8"                             , var1  )

$ splunk btool check
                Invalid key in stanza [test2] in /opt/splunk/etc/apps/PropsProblem/default/props.conf, line 7:                    FOO (value: "Command" && BAR="test4"                             , var1     ,
                   FOO="Command" && BAR="test5" && match ( var2, "xyz.*" )  , var2 , \ ).
                Invalid key in stanza [test2] in /opt/splunk/etc/apps/PropsProblem/default/props.conf, line 10:                    FOO (value: "Command" && BAR="test6"                             , var1      ,
                   FOO="Command" && BAR="test7"                             , var1      ,
                   FOO="Command" && BAR="test8"                             , var1      )).

Putting all statements on one line (as it supposed to be!) solves the problem but makes the configuration hardly readable. I would like to keep using "\" if possible.

Re: Invalid key in stanza .. in props.conf

memarshall63 — Sat, 31 Aug 2019 13:36:11 GMT

Make very sure you do not have a space or any whitespace after any of the \ characters at the end of a line. It should be \{return}. I'm seen {space}{return} cause these types of issues.

Re: Invalid key in stanza .. in props.conf

PavelP — Sat, 31 Aug 2019 13:43:18 GMT

this was it, thanks memarshall63. Post it as an answer, I'll mark it as a solution 🙂

Re: Invalid key in stanza .. in props.conf

memarshall63 — Sat, 31 Aug 2019 13:48:15 GMT

When you're getting "Invalid key in stanza" messages and your entry has some line continuation characters in it. Always check to make sure you haven't added an extra space after the backslash {\} line continuation character. Those can give you headaches and are difficult to spot.

topic Re: Invalid key in stanza .. in props.conf in Getting Data In

Invalid key in stanza .. in props.conf

Re: Invalid key in stanza .. in props.conf

Re: Invalid key in stanza .. in props.conf

Re: Invalid key in stanza .. in props.conf