Splunk Search

Possible Typos in Stanza

ananthkumar12
Explorer

Hey Experts,

I am creating an add-on for splunk v4.2 (hold your thoughts about the version) and can't seem to get around the below problem
Possible typo in stanza [omnia_secure] in /opt/splunk/etc/apps/TA-omnia_ODP_prod_Management_inputs/local/props.conf, line 3: EVAL-action = if(app="su" AND isnull(action),"success",action)

I have done a bit of research and tried this version with 's on the custom field and still get the same thing
Possible typo in stanza [omnia_secure] in /opt/splunk/etc/apps/TA-omnia_ODP_prod_Management_inputs/local/props.conf, line 3: EVAL-action = if('app'="su" AND isnull(action),"success",action)

as a result, the props and transforms are not being processed.

Have any of you faced the same and bumped into a solution??

Thanks
Ananth

Tags (4)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The version does matter. I'm pretty sure that EVAL fields in props.conf were only introduced in version 5.0, maybe 4.3.

gkanapathy
Splunk Employee
Splunk Employee

Confirmed it's only in 5.0 and up. If you compare the props.conf file spec from 5.0 with 4.3 http://docs.splunk.com/Documentation/Splunk/5.0.9/Admin/Propsconf vs http://docs.splunk.com/Documentation/Splunk/4.3.7/Admin/Propsconf you will see that EVAL is not in 4.3.x. It is also not in 4.2 or below.

Get Updates on the Splunk Community!

How to Get Started with Splunk Data Management Pipeline Builders (Edge Processor & ...

If you want to gain full control over your growing data volumes, check out Splunk’s Data Management pipeline ...

Out of the Box to Up And Running - Streamlined Observability for Your Cloud ...

  Tech Talk Streamlined Observability for Your Cloud Environment Register    Out of the Box to Up And Running ...

Splunk Smartness with Brandon Sternfield | Episode 3

Hello and welcome to another episode of "Splunk Smartness," the interview series where we explore the power of ...