How to fix error "Invalid key in stanza" in props.conf?

[deepak02]

Hi,

I am getting the below error. Please help me debug.

Invalid key in stanza

[app:BKR:PerfRest] in /opt/splunk/etc/master-apps/TA-rb-bkr/local/props.conf, line 107: eval-externalClient  (value:  case(like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/perf%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/balance-perf-summary%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v2/perf/rate-of-interest%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v2/perf/interest-data%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/equity-pattern%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v2/perf/period-data%")),"moneybags", like(sourceCall,"%/soa/bkr/rb/process/soap/v2/accountsV2/%/points%") OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/info") OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/historic-bills")  OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/rvp-deposits") OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/rvp-withdrawals") OR like(sourceCall,"/soa/bkr/rb/process/soap/v1/tx/rates") OR like(sourceCall,"/soa/bkr/rb/process/soap/v1/accounts/%/actions"),"TTC",like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/offices-open-data/%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/trade%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/time-pattern%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/indicators%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/deposits/data%") OR (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/events%") AND like(QueryString,"%eventType=RATING_CHANGES&eventType=DIVIDENDS&eventType=EARNINGS%")) OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/outlook%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/deposits/ratings%")),"MOD",like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v3/orders%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v3/orders/%")),"Orders",like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/top-movers%") OR (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/events%") AND like(OperationName,"points"))),"Points",like(_raw,"%com.rb.rac.tcp.ns1978.CustProfile.getProfile()%") OR like(_raw,"%com.rb.rac.tcp.ns1978.CustProfile.getAgreements()%") OR like(_raw,"%com.rb.rac.tcp.ns1978.CustProfile.getAccounts()%"),"TCP 2000",like(_raw,"%SELLING_CAPACITY%"),"TAP 2012"))

Props.conf is

[app:BKR:PerfRest]
eval-externalClient = case(like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/perf%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/balance-perf-summary%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v2/perf/rate-of-interest%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v2/perf/interest-data%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/equity-pattern%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v2/perf/period-data%")),"moneybags", like(sourceCall,"%/soa/bkr/rb/process/soap/v2/accountsV2/%/points%") OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/info") OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/historic-bills")  OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/rvp-deposits") OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/rvp-withdrawals") OR like(sourceCall,"/soa/bkr/rb/process/soap/v1/tx/rates") OR like(sourceCall,"/soa/bkr/rb/process/soap/v1/accounts/%/actions"),"TTC",like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/offices-open-data/%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/trade%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/time-pattern%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/indicators%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/deposits/data%") OR (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/events%") AND like(QueryString,"%eventType=RATING_CHANGES&eventType=DIVIDENDS&eventType=EARNINGS%")) OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/outlook%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/deposits/ratings%")),"MOD",like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v3/orders%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v3/orders/%")),"Orders",like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/top-movers%") OR (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/events%") AND like(OperationName,"points"))),"Points",like(_raw,"%com.rb.rac.tcp.ns1978.CustProfile.getProfile()%") OR like(_raw,"%com.rb.rac.tcp.ns1978.CustProfile.getAgreements()%") OR like(_raw,"%com.rb.rac.tcp.ns1978.CustProfile.getAccounts()%"),"TCP 2000",like(_raw,"%SELLING_CAPACITY%"),"TAP 2012")

NOTE: It is a long but extremely simple eval statement that matches fields to string and assigns a value to the case statement.

Thanks,
Deepak.

[masonmorales · Accepted solution]

The "eval" needs to be in caps (i.e. EVAL-externalClient)

[masonmorales]

@deepak02 Did this work for you?