Error in TA-pfsense

[o0chris0o]

I get the following error with TA-pFsense:

• Could not load lookup=LOOKUP-filterlog_action
• Could not load lookup=LOOKUP-filterlog_tcpflags
• Could not load lookup=LOOKUP-filterlog_transport
• Could not load lookup=LOOKUP-openvpn_action

Also all the logs in splunk are in the raw format.

I'm using TA-Splunk 2.5.0, Splunk 8.2.0. I get the data from pFsense with the universal forwarder, last version.

Did someone have the same issue?

[pBear]

I too am seeing these errors.

I had to mess with the transforms.conf and props.conf to get anything other than the filterlog to be recognized/parsed.