I am getting many of these errors in my internal log:
09-04-2019 14:04:01.152 -0500 WARN FieldAliaser - Invalid field alias specification in stanza 'OktaIM2:log': FIELDALIAS-target_displayName_as_app='target{}'
It appears the default props.conf has an invalid FIELDALIAS in version 2.25.10 (also in 2.25.6):
splunk@server:[~/etc/apps]> tar -xOzf okta-identity-cloud-add-on-for-splunk_22510.tgz TA-Okta_Identity_Cloud_for_Splunk/default/props.conf | grep FIELDALIAS-target_displayName_as_app
FIELDALIAS-target_displayName_as_app = target{}
Based on the class name, I suspect the syntax should be:
FIELDALIAS-target_displayName_as_app = target{} AS app
Yes you are correct. copy the stanza and make the change in the local directory.
from : https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Configurefieldaliaseswithprops.conf#Use...
Add the following line to a stanza in props.conf:
FIELDALIAS-<class> = <orig_field_name> AS <new_field_name>
<orig_field_name>
is the original name of the field.
<new_field_name>
is the alias to assign to the field.
You can include multiple field alias renames in one stanza.
Restart Splunk Enterprise for your changes to take effect.