Monitoring Splunk

Can btool preserve original key continuation backslashes

reed_kelly
Contributor

As most Splunkers know,

splunk cmd btool --app=fooapp foofile list

will print out the combined configuration from the file foofile.conf in the app fooapp. The problem is that some keys have values with carriage-returns in them. These are represented in the config file with a '\' at the end. For example:

[foostanza]
search = blah blah blah \
  more blah blah blah \
more=inside_search ... blah... \
done
description = foo description

This config file has two keys in the foostanza stanza: search and description. btool will print out the stanza as follows:

search = blah blah blah 
  more blah blah blah 
more=inside_search ... blah... 
done
description = foo description

This makes it look like there are three keys with junk in between them: search, more and description.

If there was a way to preserve the original '\' characters at the ends of lines, I could just do the following:

splunk cmd btool --app=fooapp foofile list >foofile_combined.conf

This would allow me to use foofile_combined.conf as the new version of foofile.conf. Unfortunately, I have to manually (ugggh) replace the end-of-line backslashes.

Does anyone have a way around this, or should I file an ER?

Tags (2)
1 Solution

RicoSuave
Builder

I'll consult with our devs, but you should file this as an enhancement request.

View solution in original post

RicoSuave
Builder

I'll consult with our devs, but you should file this as an enhancement request.

Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...