Invalid FIELDALIAS in default/props.conf

[_smp_]

I am getting many of these errors in my internal log:

09-04-2019 14:04:01.152 -0500 WARN FieldAliaser - Invalid field alias specification in stanza 'OktaIM2:log': FIELDALIAS-target_displayName_as_app='target{}'

It appears the default props.conf has an invalid FIELDALIAS in version 2.25.10 (also in 2.25.6):

splunk@server:[~/etc/apps]> tar -xOzf okta-identity-cloud-add-on-for-splunk_22510.tgz TA-Okta_Identity_Cloud_for_Splunk/default/props.conf | grep FIELDALIAS-target_displayName_as_app

FIELDALIAS-target_displayName_as_app = target{}

Based on the class name, I suspect the syntax should be:

FIELDALIAS-target_displayName_as_app = target{} AS app

[mayurr98]

Yes you are correct. copy the stanza and make the change in the local directory.
from : https://docs.splunk.com/Documentation/Splunk/7.3.1/Knowledge/Configurefieldaliaseswithprops.conf#Use...

Add the following line to a stanza in props.conf:

FIELDALIAS-<class> = <orig_field_name> AS <new_field_name>

<orig_field_name> is the original name of the field.
<new_field_name> is the alias to assign to the field.
You can include multiple field alias renames in one stanza.
Restart Splunk Enterprise for your changes to take effect.