Error in the version 6.0.2 of Splunk_TA_paloalto

[andyfromoz]

In the default/props.conf under

[pan:threat]

EVAL-url_length = if len(user_agent)

This expression is malformed
What should it be as I would like to create a local/props.conf until a new addon is released?

[btorresgil · Accepted solution]

Hello, this issue will be fixed in Palo Alto Networks Add-on 6.0.3. In the meantime, you can apply the workaround here:
https://github.com/PaloAltoNetworks/Splunk_TA_paloalto/issues/27

Apologies for the inconvenience and thank you for reporting the problem.
-Brian