Hey Experts,
I am creating an add-on for splunk v4.2 (hold your thoughts about the version) and can't seem to get around the below problem
Possible typo in stanza [omnia_secure] in /opt/splunk/etc/apps/TA-omnia_ODP_prod_Management_inputs/local/props.conf, line 3: EVAL-action = if(app="su" AND isnull(action),"success",action)
I have done a bit of research and tried this version with 's on the custom field and still get the same thing
Possible typo in stanza [omnia_secure] in /opt/splunk/etc/apps/TA-omnia_ODP_prod_Management_inputs/local/props.conf, line 3: EVAL-action = if('app'="su" AND isnull(action),"success",action)
as a result, the props and transforms are not being processed.
Have any of you faced the same and bumped into a solution??
Thanks
Ananth
The version does matter. I'm pretty sure that EVAL fields in props.conf were only introduced in version 5.0, maybe 4.3.
Confirmed it's only in 5.0 and up. If you compare the props.conf file spec from 5.0 with 4.3 http://docs.splunk.com/Documentation/Splunk/5.0.9/Admin/Propsconf vs http://docs.splunk.com/Documentation/Splunk/4.3.7/Admin/Propsconf you will see that EVAL is not in 4.3.x. It is also not in 4.2 or below.