I just installed TA EdgeRouter X in hopes of getting the syslog data from my Ubiquity UniFi USG into CIM compliance. It installed fine, but when I start Splunk, I see this error:
Invalid key in stanza [syslog] in /Applications/Splunk/etc/apps/TA-EdgeRouter_X/default/props.conf, line 20: EVAl-direction (value: case(dest_zone="WAN" AND dest_interface="eth0", "outbound", src_zone="WAN" AND src_interface="eth0", "inbound", src_zone="LOCAL" AND (dest_interface="eth1.172" OR dest_interface="eth1.192" OR dest_interface="eth1.10" ), "local", dest_interface != "eth0", "local" )).
Anyone have an idea of might might be wrong?
TIA,
Jon
This says evai not eval:
EVAl-direction
It's on line 20 in /Applications/Splunk/etc/apps/TA-EdgeRouter_X/default/props.conf
Change it to
EVAL-direction
And restart Splunk.
This says evai not eval:
EVAl-direction
It's on line 20 in /Applications/Splunk/etc/apps/TA-EdgeRouter_X/default/props.conf
Change it to
EVAL-direction
And restart Splunk.
@jespencer
That did it, thanks a lot!
fixed the typo. thanks.