Getting Data In

Invalid key in stanza .. in props.conf

Motivator

to make the configuration more readable I use "\" to break long lines, which works fine:

EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  , \
                   FOO="Command" && BAR="test2"                             , var1  , \
                   FOO="Command" && BAR="test4"                             , var1  , \
                   FOO="Command" && BAR="test6"                             , var1  , \
                   FOO="Command" && BAR="test7"                             , var1  , \
                   FOO="Command" && BAR="test8"                             , var1  )

As soon as the lines get more complex I get "Invalid key in stanza" error:

EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  , \
                   FOO="Command" && BAR="test2"                             , var1  , \
                   FOO="Command" && BAR="test3" && match ( var2, "abc.*" )  , var2  , \
                   FOO="Command" && BAR="test4"                             , var1  , \
                   FOO="Command" && BAR="test5" && match ( var2, "xyz.*" )  , var2  , \
                   FOO="Command" && BAR="test6"                             , var1  , \
                   FOO="Command" && BAR="test7"                             , var1  , \
                   FOO="Command" && BAR="test8"                             , var1  )

$ splunk btool --app=PropsProblem props list
[test2]
EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  ,
                   FOO="Command" && BAR="test2"                             , var1  ,
                   FOO="Command" && BAR="test3" && match ( var2, "abc.*" )  , var2  , \
FOO = "Command" && BAR="test6"                             , var1  ,
                   FOO="Command" && BAR="test7"                             , var1  ,
                   FOO="Command" && BAR="test8"                             , var1  )

$ splunk btool check
                Invalid key in stanza [test2] in /opt/splunk/etc/apps/PropsProblem/default/props.conf, line 7:                    FOO (value: "Command" && BAR="test4"                             , var1     ,
                   FOO="Command" && BAR="test5" && match ( var2, "xyz.*" )  , var2 , \ ).
                Invalid key in stanza [test2] in /opt/splunk/etc/apps/PropsProblem/default/props.conf, line 10:                    FOO (value: "Command" && BAR="test6"                             , var1      ,
                   FOO="Command" && BAR="test7"                             , var1      ,
                   FOO="Command" && BAR="test8"                             , var1      )).

Putting all statements on one line (as it supposed to be!) solves the problem but makes the configuration hardly readable. I would like to keep using "\" if possible.

0 Karma
1 Solution

Communicator

When you're getting "Invalid key in stanza" messages and your entry has some line continuation characters in it. Always check to make sure you haven't added an extra space after the backslash {\} line continuation character. Those can give you headaches and are difficult to spot.

View solution in original post

0 Karma

Communicator

When you're getting "Invalid key in stanza" messages and your entry has some line continuation characters in it. Always check to make sure you haven't added an extra space after the backslash {\} line continuation character. Those can give you headaches and are difficult to spot.

View solution in original post

0 Karma

Communicator

Make very sure you do not have a space or any whitespace after any of the \ characters at the end of a line. It should be \{return}. I'm seen {space}{return} cause these types of issues.

Motivator

this was it, thanks memarshall63. Post it as an answer, I'll mark it as a solution 🙂

0 Karma