All Apps and Add-ons

Invalid key in stanza error for TA EdgeRouter X

Jon_Irish
Explorer

I just installed TA EdgeRouter X in hopes of getting the syslog data from my Ubiquity UniFi USG into CIM compliance. It installed fine, but when I start Splunk, I see this error:

Invalid key in stanza [syslog] in /Applications/Splunk/etc/apps/TA-EdgeRouter_X/default/props.conf, line 20: EVAl-direction (value: case(dest_zone="WAN" AND dest_interface="eth0", "outbound", src_zone="WAN" AND src_interface="eth0", "inbound", src_zone="LOCAL" AND (dest_interface="eth1.172" OR dest_interface="eth1.192" OR dest_interface="eth1.10" ), "local", dest_interface != "eth0", "local" )).

Anyone have an idea of might might be wrong?

TIA,
Jon

0 Karma
1 Solution

jkat54
SplunkTrust
SplunkTrust

This says evai not eval:

EVAl-direction

It's on line 20 in /Applications/Splunk/etc/apps/TA-EdgeRouter_X/default/props.conf

Change it to

EVAL-direction

And restart Splunk.

View solution in original post

jkat54
SplunkTrust
SplunkTrust

This says evai not eval:

EVAl-direction

It's on line 20 in /Applications/Splunk/etc/apps/TA-EdgeRouter_X/default/props.conf

Change it to

EVAL-direction

And restart Splunk.

jkat54
SplunkTrust
SplunkTrust

@jespencer

0 Karma

Jon_Irish
Explorer

That did it, thanks a lot!

0 Karma

jespencer
Engager

fixed the typo. thanks.

0 Karma
Get Updates on the Splunk Community!

.conf23 Registration is Now Open!

Time to toss the .conf-etti 🎉 —  .conf23 registration is open!   Join us in Las Vegas July 17-20 for ...

Don't wait! Accept the Mission Possible: Splunk Adoption Challenge Now and Win ...

Attention everyone! We have exciting news to share! We are recruiting new members for the Mission Possible: ...

Unify Your SecOps with Splunk Mission Control

In today’s post, I'm excited to share some recent Splunk Mission Control innovations. With Splunk Mission ...