Possible Typos in Stanza

[ananthkumar12]

Hey Experts,

I am creating an add-on for splunk v4.2 (hold your thoughts about the version) and can't seem to get around the below problem
Possible typo in stanza [omnia_secure] in /opt/splunk/etc/apps/TA-omnia_ODP_prod_Management_inputs/local/props.conf, line 3: EVAL-action = if(app="su" AND isnull(action),"success",action)

I have done a bit of research and tried this version with 's on the custom field and still get the same thing
Possible typo in stanza [omnia_secure] in /opt/splunk/etc/apps/TA-omnia_ODP_prod_Management_inputs/local/props.conf, line 3: EVAL-action = if('app'="su" AND isnull(action),"success",action)

as a result, the props and transforms are not being processed.

Have any of you faced the same and bumped into a solution??

Thanks
Ananth

[gkanapathy]

The version does matter. I'm pretty sure that EVAL fields in props.conf were only introduced in version 5.0, maybe 4.3.

[gkanapathy]

Confirmed it's only in 5.0 and up. If you compare the props.conf file spec from 5.0 with 4.3 http://docs.splunk.com/Documentation/Splunk/5.0.9/Admin/Propsconf vs http://docs.splunk.com/Documentation/Splunk/4.3.7/Admin/Propsconf you will see that EVAL is not in 4.3.x. It is also not in 4.2 or below.