All Apps and Add-ons
Highlighted

Invalid key in stanza error for TA EdgeRouter X

Explorer

I just installed TA EdgeRouter X in hopes of getting the syslog data from my Ubiquity UniFi USG into CIM compliance. It installed fine, but when I start Splunk, I see this error:

Invalid key in stanza [syslog] in /Applications/Splunk/etc/apps/TA-EdgeRouterX/default/props.conf, line 20: EVAl-direction (value: case(destzone="WAN" AND destinterface="eth0", "outbound", srczone="WAN" AND srcinterface="eth0", "inbound", srczone="LOCAL" AND (destinterface="eth1.172" OR destinterface="eth1.192" OR destinterface="eth1.10" ), "local", destinterface != "eth0", "local" )).

Anyone have an idea of might might be wrong?

TIA,
Jon

0 Karma
Highlighted

Re: Invalid key in stanza error for TA EdgeRouter X

SplunkTrust
SplunkTrust

This says evai not eval:

EVAl-direction

It's on line 20 in /Applications/Splunk/etc/apps/TA-EdgeRouter_X/default/props.conf

Change it to

EVAL-direction

And restart Splunk.

View solution in original post

Highlighted

Re: Invalid key in stanza error for TA EdgeRouter X

SplunkTrust
SplunkTrust

@jespencer

0 Karma
Highlighted

Re: Invalid key in stanza error for TA EdgeRouter X

Engager

fixed the typo. thanks.

0 Karma
Highlighted

Re: Invalid key in stanza error for TA EdgeRouter X

Explorer

That did it, thanks a lot!

0 Karma