From 4da7ae85e2aff77e29e3d29404fbe817ce31a0d4 Mon Sep 17 00:00:00 2001
From: Mark Bonsack <mbonsack@splunk.com>
Date: Wed, 11 Mar 2020 16:34:48 -0700
Subject: [PATCH] Startup log path `splunk_indexes.conf` fix

* Fix sourcetype/key reversal in startup log path
---
 package/etc/conf.d/log_paths/lp-sc4s_startup.conf.tmpl | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/package/etc/conf.d/log_paths/lp-sc4s_startup.conf.tmpl b/package/etc/conf.d/log_paths/lp-sc4s_startup.conf.tmpl
index ab4c5c7..b255e92 100644
--- a/package/etc/conf.d/log_paths/lp-sc4s_startup.conf.tmpl
+++ b/package/etc/conf.d/log_paths/lp-sc4s_startup.conf.tmpl
@@ -3,8 +3,8 @@
 log {
     source(s_startup_out);
 
-    rewrite { r_set_splunk_dest_default(sourcetype("sc4s:events"), index("main"))};
-    parser {p_add_context_splunk(key("sc4s_events:startup:out")); };
+    rewrite { r_set_splunk_dest_default(sourcetype("sc4s_events:startup:out"), index("main"))};
+    parser {p_add_context_splunk(key("sc4s:events")); };
 
     {{- if or (conv.ToBool (getenv "SC4S_DEST_SPLUNK_HEC_GLOBAL" "yes")) (conv.ToBool (getenv "SC4S_DEST_INTERNAL_EVENTS_HEC" "no")) }}
     destination(d_hec_internal);