multikv command can have no fields; we should omit new line (\n)

salspaugh / splparser

Simple parser for Splunk Processing Language (SPL) written in Python.

Other

35 stars 14 forks source link

Open keroro824 opened 10 years ago

keroro824 commented 10 years ago

eg. search set_sos_index host="SPLUNK1.EDM.LOCAL" sourcetype="lsof"\n | head 1\n | multikv \n | get_splunk_process_type_lsof

salspaugh commented 10 years ago

This is a weird one -- I thought the newline should be ignored already. Perhaps it is an escaped escape.