Splunk Search

Possible Typos in Stanza


Hey Experts,

I am creating an add-on for splunk v4.2 (hold your thoughts about the version) and can't seem to get around the below problem
Possible typo in stanza [omnia_secure] in /opt/splunk/etc/apps/TA-omnia_ODP_prod_Management_inputs/local/props.conf, line 3: EVAL-action = if(app="su" AND isnull(action),"success",action)

I have done a bit of research and tried this version with 's on the custom field and still get the same thing
Possible typo in stanza [omnia_secure] in /opt/splunk/etc/apps/TA-omnia_ODP_prod_Management_inputs/local/props.conf, line 3: EVAL-action = if('app'="su" AND isnull(action),"success",action)

as a result, the props and transforms are not being processed.

Have any of you faced the same and bumped into a solution??


Tags (4)
0 Karma

Splunk Employee
Splunk Employee

The version does matter. I'm pretty sure that EVAL fields in props.conf were only introduced in version 5.0, maybe 4.3.

Splunk Employee
Splunk Employee

Confirmed it's only in 5.0 and up. If you compare the props.conf file spec from 5.0 with 4.3 http://docs.splunk.com/Documentation/Splunk/5.0.9/Admin/Propsconf vs http://docs.splunk.com/Documentation/Splunk/4.3.7/Admin/Propsconf you will see that EVAL is not in 4.3.x. It is also not in 4.2 or below.

.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!