Getting Data In

Invalid key in stanza .. in props.conf

PavelP
Motivator

to make the configuration more readable I use "\" to break long lines, which works fine:

EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  , \
                   FOO="Command" && BAR="test2"                             , var1  , \
                   FOO="Command" && BAR="test4"                             , var1  , \
                   FOO="Command" && BAR="test6"                             , var1  , \
                   FOO="Command" && BAR="test7"                             , var1  , \
                   FOO="Command" && BAR="test8"                             , var1  )

As soon as the lines get more complex I get "Invalid key in stanza" error:

EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  , \
                   FOO="Command" && BAR="test2"                             , var1  , \
                   FOO="Command" && BAR="test3" && match ( var2, "abc.*" )  , var2  , \
                   FOO="Command" && BAR="test4"                             , var1  , \
                   FOO="Command" && BAR="test5" && match ( var2, "xyz.*" )  , var2  , \
                   FOO="Command" && BAR="test6"                             , var1  , \
                   FOO="Command" && BAR="test7"                             , var1  , \
                   FOO="Command" && BAR="test8"                             , var1  )

$ splunk btool --app=PropsProblem props list
[test2]
EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  ,
                   FOO="Command" && BAR="test2"                             , var1  ,
                   FOO="Command" && BAR="test3" && match ( var2, "abc.*" )  , var2  , \
FOO = "Command" && BAR="test6"                             , var1  ,
                   FOO="Command" && BAR="test7"                             , var1  ,
                   FOO="Command" && BAR="test8"                             , var1  )

$ splunk btool check
                Invalid key in stanza [test2] in /opt/splunk/etc/apps/PropsProblem/default/props.conf, line 7:                    FOO (value: "Command" && BAR="test4"                             , var1     ,
                   FOO="Command" && BAR="test5" && match ( var2, "xyz.*" )  , var2 , \ ).
                Invalid key in stanza [test2] in /opt/splunk/etc/apps/PropsProblem/default/props.conf, line 10:                    FOO (value: "Command" && BAR="test6"                             , var1      ,
                   FOO="Command" && BAR="test7"                             , var1      ,
                   FOO="Command" && BAR="test8"                             , var1      )).

Putting all statements on one line (as it supposed to be!) solves the problem but makes the configuration hardly readable. I would like to keep using "\" if possible.

0 Karma
1 Solution

memarshall63
Communicator

When you're getting "Invalid key in stanza" messages and your entry has some line continuation characters in it. Always check to make sure you haven't added an extra space after the backslash {\} line continuation character. Those can give you headaches and are difficult to spot.

View solution in original post

0 Karma

memarshall63
Communicator

When you're getting "Invalid key in stanza" messages and your entry has some line continuation characters in it. Always check to make sure you haven't added an extra space after the backslash {\} line continuation character. Those can give you headaches and are difficult to spot.

0 Karma

memarshall63
Communicator

Make very sure you do not have a space or any whitespace after any of the \ characters at the end of a line. It should be \{return}. I'm seen {space}{return} cause these types of issues.

PavelP
Motivator

this was it, thanks memarshall63. Post it as an answer, I'll mark it as a solution 🙂

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...