Getting Data In

Invalid key in stanza .. in props.conf

PavelP
Motivator

to make the configuration more readable I use "\" to break long lines, which works fine:

EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  , \
                   FOO="Command" && BAR="test2"                             , var1  , \
                   FOO="Command" && BAR="test4"                             , var1  , \
                   FOO="Command" && BAR="test6"                             , var1  , \
                   FOO="Command" && BAR="test7"                             , var1  , \
                   FOO="Command" && BAR="test8"                             , var1  )

As soon as the lines get more complex I get "Invalid key in stanza" error:

EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  , \
                   FOO="Command" && BAR="test2"                             , var1  , \
                   FOO="Command" && BAR="test3" && match ( var2, "abc.*" )  , var2  , \
                   FOO="Command" && BAR="test4"                             , var1  , \
                   FOO="Command" && BAR="test5" && match ( var2, "xyz.*" )  , var2  , \
                   FOO="Command" && BAR="test6"                             , var1  , \
                   FOO="Command" && BAR="test7"                             , var1  , \
                   FOO="Command" && BAR="test8"                             , var1  )

$ splunk btool --app=PropsProblem props list
[test2]
EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  ,
                   FOO="Command" && BAR="test2"                             , var1  ,
                   FOO="Command" && BAR="test3" && match ( var2, "abc.*" )  , var2  , \
FOO = "Command" && BAR="test6"                             , var1  ,
                   FOO="Command" && BAR="test7"                             , var1  ,
                   FOO="Command" && BAR="test8"                             , var1  )

$ splunk btool check
                Invalid key in stanza [test2] in /opt/splunk/etc/apps/PropsProblem/default/props.conf, line 7:                    FOO (value: "Command" && BAR="test4"                             , var1     ,
                   FOO="Command" && BAR="test5" && match ( var2, "xyz.*" )  , var2 , \ ).
                Invalid key in stanza [test2] in /opt/splunk/etc/apps/PropsProblem/default/props.conf, line 10:                    FOO (value: "Command" && BAR="test6"                             , var1      ,
                   FOO="Command" && BAR="test7"                             , var1      ,
                   FOO="Command" && BAR="test8"                             , var1      )).

Putting all statements on one line (as it supposed to be!) solves the problem but makes the configuration hardly readable. I would like to keep using "\" if possible.

0 Karma
1 Solution

memarshall63
Communicator

When you're getting "Invalid key in stanza" messages and your entry has some line continuation characters in it. Always check to make sure you haven't added an extra space after the backslash {\} line continuation character. Those can give you headaches and are difficult to spot.

View solution in original post

0 Karma

memarshall63
Communicator

When you're getting "Invalid key in stanza" messages and your entry has some line continuation characters in it. Always check to make sure you haven't added an extra space after the backslash {\} line continuation character. Those can give you headaches and are difficult to spot.

View solution in original post

0 Karma

memarshall63
Communicator

Make very sure you do not have a space or any whitespace after any of the \ characters at the end of a line. It should be \{return}. I'm seen {space}{return} cause these types of issues.

PavelP
Motivator

this was it, thanks memarshall63. Post it as an answer, I'll mark it as a solution 🙂

0 Karma
Take the 2021 Splunk Career Survey

Help us learn about how Splunk has
impacted your career by taking the 2021 Splunk Career Survey.

Earn $50 in Amazon cash!