Getting Data In

How to fix error "Invalid key in stanza" in props.conf?

deepak02
Path Finder

Hi,

I am getting the below error. Please help me debug.

Invalid key in stanza

[app:BKR:PerfRest] in /opt/splunk/etc/master-apps/TA-rb-bkr/local/props.conf, line 107: eval-externalClient  (value:  case(like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/perf%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/balance-perf-summary%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v2/perf/rate-of-interest%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v2/perf/interest-data%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/equity-pattern%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v2/perf/period-data%")),"moneybags", like(sourceCall,"%/soa/bkr/rb/process/soap/v2/accountsV2/%/points%") OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/info") OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/historic-bills")  OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/rvp-deposits") OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/rvp-withdrawals") OR like(sourceCall,"/soa/bkr/rb/process/soap/v1/tx/rates") OR like(sourceCall,"/soa/bkr/rb/process/soap/v1/accounts/%/actions"),"TTC",like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/offices-open-data/%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/trade%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/time-pattern%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/indicators%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/deposits/data%") OR (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/events%") AND like(QueryString,"%eventType=RATING_CHANGES&eventType=DIVIDENDS&eventType=EARNINGS%")) OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/outlook%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/deposits/ratings%")),"MOD",like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v3/orders%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v3/orders/%")),"Orders",like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/top-movers%") OR (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/events%") AND like(OperationName,"points"))),"Points",like(_raw,"%com.rb.rac.tcp.ns1978.CustProfile.getProfile()%") OR like(_raw,"%com.rb.rac.tcp.ns1978.CustProfile.getAgreements()%") OR like(_raw,"%com.rb.rac.tcp.ns1978.CustProfile.getAccounts()%"),"TCP 2000",like(_raw,"%SELLING_CAPACITY%"),"TAP 2012"))

Props.conf is

[app:BKR:PerfRest]
eval-externalClient = case(like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/perf%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/balance-perf-summary%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v2/perf/rate-of-interest%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v2/perf/interest-data%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/equity-pattern%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v2/perf/period-data%")),"moneybags", like(sourceCall,"%/soa/bkr/rb/process/soap/v2/accountsV2/%/points%") OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/info") OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/historic-bills")  OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/rvp-deposits") OR like(sourceCall,"/soa/bkr/rb/process/soap/v2/accountsV2/%/rvp-withdrawals") OR like(sourceCall,"/soa/bkr/rb/process/soap/v1/tx/rates") OR like(sourceCall,"/soa/bkr/rb/process/soap/v1/accounts/%/actions"),"TTC",like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/offices-open-data/%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/trade%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/time-pattern%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/indicators%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/deposits/data%") OR (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/events%") AND like(QueryString,"%eventType=RATING_CHANGES&eventType=DIVIDENDS&eventType=EARNINGS%")) OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/office/outlook%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v1/deposits/ratings%")),"MOD",like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v3/orders%") OR like(sourceCall,"%/soa/bkr/rb/process/soap/v3/orders/%")),"Orders",like(grade,"%client.callout.SOAPPatternCallout%") AND (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/top-movers%") OR (like(sourceCall,"%/soa/bkr/rb/process/soap/v1/account/events%") AND like(OperationName,"points"))),"Points",like(_raw,"%com.rb.rac.tcp.ns1978.CustProfile.getProfile()%") OR like(_raw,"%com.rb.rac.tcp.ns1978.CustProfile.getAgreements()%") OR like(_raw,"%com.rb.rac.tcp.ns1978.CustProfile.getAccounts()%"),"TCP 2000",like(_raw,"%SELLING_CAPACITY%"),"TAP 2012")

NOTE: It is a long but extremely simple eval statement that matches fields to string and assigns a value to the case statement.

Thanks,
Deepak.

Tags (2)
0 Karma
1 Solution

masonmorales
Influencer

The "eval" needs to be in caps (i.e. EVAL-externalClient)

View solution in original post

masonmorales
Influencer

The "eval" needs to be in caps (i.e. EVAL-externalClient)

masonmorales
Influencer

@deepak02 Did this work for you?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...