A couple of things for your consideration. In macros.conf, you have definition lines that contain variables of the format $variable$. In eventtypes.conf, there are some specially-named eventttype stanzas of the form [somelog-%code%] -- when searching you can use eventtype=somelog-404 and splunk would add code=404 to the eventtype's search definition (this is really good for windows logs, i.e. [windows-%event_id%]).
I noticed that I had a few errors with confString and confNumbers. Also, I think its nice to have several of the constant types (numbers, variables) highlighted within strings.
A couple of things for your consideration. In macros.conf, you have definition lines that contain variables of the format $variable$. In eventtypes.conf, there are some specially-named eventttype stanzas of the form [somelog-%code%] -- when searching you can use eventtype=somelog-404 and splunk would add code=404 to the eventtype's search definition (this is really good for windows logs, i.e. [windows-%event_id%]).
I noticed that I had a few errors with confString and confNumbers. Also, I think its nice to have several of the constant types (numbers, variables) highlighted within strings.