From 01fbe9fec602bf18cd1486267ddf4ee08fcd8eb8 Mon Sep 17 00:00:00 2001
From: mbonsack <mbonsack@splunk.com>
Date: Fri, 8 May 2020 11:04:54 -0700
Subject: [PATCH] Update splunkfields.conf.tmpl

---
 package/etc/conf.d/conflib/_splunk/splunkfields.conf.tmpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/etc/conf.d/conflib/_splunk/splunkfields.conf.tmpl b/package/etc/conf.d/conflib/_splunk/splunkfields.conf.tmpl
index 62bfca7..f340bb3 100644
--- a/package/etc/conf.d/conflib/_splunk/splunkfields.conf.tmpl
+++ b/package/etc/conf.d/conflib/_splunk/splunkfields.conf.tmpl
@@ -9,7 +9,7 @@ rewrite r_set_splunk_default {
 {{- end}}      
 {{- if (split (getenv "SC4S_DEST_SPLUNK_INDEXED_FIELDS" "facility,severity,container,log_host,dport,fromhostip,proto") ",") has "log_host" }}
 {{- if (getenv "SC4S_CONTAINER_HOST") }}
-      set("{{ getenv "SC4S_CONTAINER_HOST" }}", value("fields.sc4s_log_host"));
+      set("{{ getenv "SC4S_CONTAINER_HOST" }}", value("fields.sc4s_loghost"));
 {{- end}}      
 {{- end}}      
 {{- if (split (getenv "SC4S_DEST_SPLUNK_INDEXED_FIELDS" "facility,severity,container,log_host,dport,fromhostip,proto") ",") has "container" }}