to make the configuration more readable I use "\" to break long lines, which works fine:
EVAL-user = case ( FOO="Action" && BAR="test1" , var1 , \
FOO="Command" && BAR="test2" , var1 , \
FOO="Command" && BAR="test4" , var1 , \
FOO="Command" && BAR="test6" , var1 , \
FOO="Command" && BAR="test7" , var1 , \
FOO="Command" && BAR="test8" , var1 )
As soon as the lines get more complex I get "Invalid key in stanza" error:
EVAL-user = case ( FOO="Action" && BAR="test1" , var1 , \
FOO="Command" && BAR="test2" , var1 , \
FOO="Command" && BAR="test3" && match ( var2, "abc.*" ) , var2 , \
FOO="Command" && BAR="test4" , var1 , \
FOO="Command" && BAR="test5" && match ( var2, "xyz.*" ) , var2 , \
FOO="Command" && BAR="test6" , var1 , \
FOO="Command" && BAR="test7" , var1 , \
FOO="Command" && BAR="test8" , var1 )
$ splunk btool --app=PropsProblem props list
[test2]
EVAL-user = case ( FOO="Action" && BAR="test1" , var1 ,
FOO="Command" && BAR="test2" , var1 ,
FOO="Command" && BAR="test3" && match ( var2, "abc.*" ) , var2 , \
FOO = "Command" && BAR="test6" , var1 ,
FOO="Command" && BAR="test7" , var1 ,
FOO="Command" && BAR="test8" , var1 )
$ splunk btool check
Invalid key in stanza [test2] in /opt/splunk/etc/apps/PropsProblem/default/props.conf, line 7: FOO (value: "Command" && BAR="test4" , var1 ,
FOO="Command" && BAR="test5" && match ( var2, "xyz.*" ) , var2 , \ ).
Invalid key in stanza [test2] in /opt/splunk/etc/apps/PropsProblem/default/props.conf, line 10: FOO (value: "Command" && BAR="test6" , var1 ,
FOO="Command" && BAR="test7" , var1 ,
FOO="Command" && BAR="test8" , var1 )).
Putting all statements on one line (as it supposed to be!) solves the problem but makes the configuration hardly readable. I would like to keep using "\" if possible.
↧