Reporting

Btool multiline values don't have the '\' between lines that conf files have. How do I make them appear?

nwales
Path Finder

Running btool to create a combined config file from default and local doesn't give me a working config file because the line continuation marks are missing:

A search in the existing savedsearches.conf looks like:

search = source="/path/to/logfile.log" checkoutId (checkoutWithVas OR checkoutWithNoVas)\
| regex "checkoutId=[\w\d-]{32}" \
| rex "Domain: (?[\w\d.]+) Path:"\

While the output of btool looks like:

search = source="/path/to/logfile.log" checkoutId (checkoutWithVas OR checkoutWithNoVas)
| regex "checkoutId=[\w\d-]{32}" 
| rex "Domain: (?[\w\d.]+) Path:"

Any way to make them magically appear?

nwales
Path Finder

I tried that, worked this problem out when splunk complained about the config I had dumped to file.

0 Karma

woodcock
Esteemed Legend

Try dumping it to a file; it is possible that the terminal process is eating them when displaying to STDOUT.

0 Karma
Get Updates on the Splunk Community!

Exporting Splunk Apps

Join us on Monday, October 21 at 11 am PT | 2 pm ET!With the app export functionality, app developers and ...

Cisco Use Cases, ITSI Best Practices, and More New Articles from Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Build Your First SPL2 App!

Watch the recording now!.Do you want to SPL™, too? SPL2, Splunk's next-generation data search and preparation ...