topic Re: TA Meraki: how do I fix the bug I found in my splunkd.log? in All Apps and Add-ons

TA Meraki: how do I fix the bug I found in my splunkd.log?

jcooperFossil — Fri, 07 Sep 2018 19:24:54 GMT

In the props.conf of the TA on line 65 is the following:

EVAL-lease_scope = if(len(lease_scope_subnet)=>1,src."/".lease_scope_subnet,null())

Looking through my splunkd.log, I see the below error. Sadly my regex-fu isn't that good; what is wrong, and how would I fix it?

WARN  CalcFieldProcessor - Invalid eval expression for 'EVAL-lease_scope' in stanza [meraki]: The expression is malformed. An unexpected character is reached at '>1,src."/".lease_scope_subnet,null())

Re: TA Meraki: how do I fix the bug I found in my splunkd.log?

adonio — Fri, 07 Sep 2018 19:44:16 GMT

hello there,

see what it tries to do,
create your on expression for lease_scope
create local folder in the TA and add new props.conf with the correction
make sure you ally the configuration the correct [stanza]

please share your solution with us so others can enjoy too!

Re: TA Meraki: how do I fix the bug I found in my splunkd.log?

jcooperFossil — Fri, 07 Sep 2018 19:51:49 GMT

I have no idea what it is trying to do (which is why I posted this question). I'm just trying to clean up errors in the logs.
Thanks for replying though.

Re: TA Meraki: how do I fix the bug I found in my splunkd.log?

worshamn — Sat, 08 Sep 2018 17:25:17 GMT

It is just a syntax error in your greater than or equal to expression. Swap the > and = signs around.
You can recreate the problem in SPL by just doing this:

| makeresults 
| eval test = 2
| eval test2 = if(len(test) => 1, "yes", null())

See it error and then see it happy with:

| makeresults 
| eval test = 2
| eval test2 = if(len(test) >= 1, "yes", null())

Re: TA Meraki: how do I fix the bug I found in my splunkd.log?

jcooperFossil — Mon, 10 Sep 2018 14:36:40 GMT

Thanks Worshamm!

Re: TA Meraki: how do I fix the bug I found in my splunkd.log?

myron_davis — Tue, 29 Sep 2020 21:22:03 GMT

I'll investigate. That was one I never caught... sorry.

The purpose was for the DHCP tag under the common information model "Sessions"

DHCP lease_scope string The consecutive range of possible IP addresses that the DHCP server can lease to clients on a subnet. A lease_scope typically defines a single physical subnet on your network to which DHCP services are offered.

I thought I tested it against several different pieces of data. But I missed that one :(.

After testing it I'll upload a new package.

Re: TA Meraki: how do I fix the bug I found in my splunkd.log?

jmantor — Tue, 20 Aug 2019 20:46:06 GMT

A co-worker of mine just discovered that we're seeing the same error in version 1.0.6.
Just wondering if that is fixed in later versions?

Re: TA Meraki: how do I fix the bug I found in my splunkd.log?

myron_davis — Tue, 20 Aug 2019 21:31:23 GMT

I pushed out a new release into the repo:
https://github.com/AlaskaSSO/TA-meraki/releases/tag/v1.1.2

If it looks good I'll push it up to the splunk app store.