Reporting

Btool multiline values don't have the '\' between lines that conf files have. How do I make them appear?

nwales
Path Finder

Running btool to create a combined config file from default and local doesn't give me a working config file because the line continuation marks are missing:

A search in the existing savedsearches.conf looks like:

search = source="/path/to/logfile.log" checkoutId (checkoutWithVas OR checkoutWithNoVas)\
| regex "checkoutId=[\w\d-]{32}" \
| rex "Domain: (?[\w\d.]+) Path:"\

While the output of btool looks like:

search = source="/path/to/logfile.log" checkoutId (checkoutWithVas OR checkoutWithNoVas)
| regex "checkoutId=[\w\d-]{32}" 
| rex "Domain: (?[\w\d.]+) Path:"

Any way to make them magically appear?

nwales
Path Finder

I tried that, worked this problem out when splunk complained about the config I had dumped to file.

0 Karma

woodcock
Esteemed Legend

Try dumping it to a file; it is possible that the terminal process is eating them when displaying to STDOUT.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...