Splunk Search

Possible Typos in Stanza

ananthkumar12
Explorer

Hey Experts,

I am creating an add-on for splunk v4.2 (hold your thoughts about the version) and can't seem to get around the below problem
Possible typo in stanza [omnia_secure] in /opt/splunk/etc/apps/TA-omnia_ODP_prod_Management_inputs/local/props.conf, line 3: EVAL-action = if(app="su" AND isnull(action),"success",action)

I have done a bit of research and tried this version with 's on the custom field and still get the same thing
Possible typo in stanza [omnia_secure] in /opt/splunk/etc/apps/TA-omnia_ODP_prod_Management_inputs/local/props.conf, line 3: EVAL-action = if('app'="su" AND isnull(action),"success",action)

as a result, the props and transforms are not being processed.

Have any of you faced the same and bumped into a solution??

Thanks
Ananth

Tags (4)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee

The version does matter. I'm pretty sure that EVAL fields in props.conf were only introduced in version 5.0, maybe 4.3.

gkanapathy
Splunk Employee
Splunk Employee

Confirmed it's only in 5.0 and up. If you compare the props.conf file spec from 5.0 with 4.3 http://docs.splunk.com/Documentation/Splunk/5.0.9/Admin/Propsconf vs http://docs.splunk.com/Documentation/Splunk/4.3.7/Admin/Propsconf you will see that EVAL is not in 4.3.x. It is also not in 4.2 or below.

Get Updates on the Splunk Community!

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...

State of Splunk Careers 2024: Maximizing Career Outcomes and the Continued Value of ...

For the past four years, Splunk has partnered with Enterprise Strategy Group to conduct a survey that gauges ...

Data-Driven Success: Splunk & Financial Services

Splunk streamlines the process of extracting insights from large volumes of data. In this fast-paced world, ...