When modifying serverclass.conf, which safeguards could help us avoid the following mistakes?

[ddrillic]

The constantly updated serverclass.confhere creates all kinds of commotion. Today it was realized that we have the following:

[serverClass:<name>]
whiteline.0 = <host1>
whiteline.1 = <host2>
whiteline.2 = <host3>
whiteline.3 = <host4>
whiteline.4 = <host5>
....

Meaning, whitelist was written as whiteline by mistake. So, which safeguards we can put in place to avoid these mistakes/commotions?

[harsmarvania57 · Accepted solution]

Hi @ddrillic,

You can use btool, please refer this document http://docs.splunk.com/Documentation/Splunk/7.1.3/Troubleshooting/CommandlinetoolsforusewithSupport

Check for typos: ./splunk cmd btool check

[ddrillic]

Gorgeous @harsmarvania57!

$ ./splunk cmd btool check

                Invalid key in stanza [serverClass:<class>] in /opt/splunk/etc/system/local/serverclass.conf, line 21: whiteline.0

[ddrillic]

Interestingly, it doesn't catch something like -

whitelist.92 = <host>
whitelist.93 = <host>
whitelist.94 = <host>
whitelist.95 = <host>
# number repetition 
whitelist.92 = <host>
whitelist.93 = <host>