From 1f02296db1c35107f6b610b976c48a085dbf859d Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Thu, 12 Dec 2019 23:14:16 -0500
Subject: [PATCH] Update p_rfc3165-symantec_brightmail.conf.tmpl

---
 .../conf.d/log_paths/p_rfc3165-symantec_brightmail.conf.tmpl    | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/etc/conf.d/log_paths/p_rfc3165-symantec_brightmail.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc3165-symantec_brightmail.conf.tmpl
index ae26f0f..21ca1eb 100644
--- a/package/etc/conf.d/log_paths/p_rfc3165-symantec_brightmail.conf.tmpl
+++ b/package/etc/conf.d/log_paths/p_rfc3165-symantec_brightmail.conf.tmpl
@@ -13,7 +13,7 @@ parser symantec_brightmail_grouping {
         key("${SMG.seq}")
         timeout(2)
         aggregate(
-             value("MESSAGE" "${PID}|${SMG.seq}|$(implode ';' $(context-values ${MESSAGE}))")
+             value("MESSAGE" ";CONTEXT|${PID};${SMG.seq}|$(implode ';' $(context-values ${MESSAGE}))")
              value("SMG.COMPLETE" "yes")
         )
     );