Getting Data In

Invalid key in stanza .. in props.conf

PavelP
Motivator

to make the configuration more readable I use "\" to break long lines, which works fine:

EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  , \
                   FOO="Command" && BAR="test2"                             , var1  , \
                   FOO="Command" && BAR="test4"                             , var1  , \
                   FOO="Command" && BAR="test6"                             , var1  , \
                   FOO="Command" && BAR="test7"                             , var1  , \
                   FOO="Command" && BAR="test8"                             , var1  )

As soon as the lines get more complex I get "Invalid key in stanza" error:

EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  , \
                   FOO="Command" && BAR="test2"                             , var1  , \
                   FOO="Command" && BAR="test3" && match ( var2, "abc.*" )  , var2  , \
                   FOO="Command" && BAR="test4"                             , var1  , \
                   FOO="Command" && BAR="test5" && match ( var2, "xyz.*" )  , var2  , \
                   FOO="Command" && BAR="test6"                             , var1  , \
                   FOO="Command" && BAR="test7"                             , var1  , \
                   FOO="Command" && BAR="test8"                             , var1  )

$ splunk btool --app=PropsProblem props list
[test2]
EVAL-user = case ( FOO="Action"  && BAR="test1"                             , var1  ,
                   FOO="Command" && BAR="test2"                             , var1  ,
                   FOO="Command" && BAR="test3" && match ( var2, "abc.*" )  , var2  , \
FOO = "Command" && BAR="test6"                             , var1  ,
                   FOO="Command" && BAR="test7"                             , var1  ,
                   FOO="Command" && BAR="test8"                             , var1  )

$ splunk btool check
                Invalid key in stanza [test2] in /opt/splunk/etc/apps/PropsProblem/default/props.conf, line 7:                    FOO (value: "Command" && BAR="test4"                             , var1     ,
                   FOO="Command" && BAR="test5" && match ( var2, "xyz.*" )  , var2 , \ ).
                Invalid key in stanza [test2] in /opt/splunk/etc/apps/PropsProblem/default/props.conf, line 10:                    FOO (value: "Command" && BAR="test6"                             , var1      ,
                   FOO="Command" && BAR="test7"                             , var1      ,
                   FOO="Command" && BAR="test8"                             , var1      )).

Putting all statements on one line (as it supposed to be!) solves the problem but makes the configuration hardly readable. I would like to keep using "\" if possible.

0 Karma
1 Solution

memarshall63
Communicator

When you're getting "Invalid key in stanza" messages and your entry has some line continuation characters in it. Always check to make sure you haven't added an extra space after the backslash {\} line continuation character. Those can give you headaches and are difficult to spot.

View solution in original post

0 Karma

memarshall63
Communicator

When you're getting "Invalid key in stanza" messages and your entry has some line continuation characters in it. Always check to make sure you haven't added an extra space after the backslash {\} line continuation character. Those can give you headaches and are difficult to spot.

0 Karma

memarshall63
Communicator

Make very sure you do not have a space or any whitespace after any of the \ characters at the end of a line. It should be \{return}. I'm seen {space}{return} cause these types of issues.

PavelP
Motivator

this was it, thanks memarshall63. Post it as an answer, I'll mark it as a solution 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...