Fix glob for checkpoint

CSVD · Apr 8, 2020 · 5d8cedb · 5d8cedb
1 parent 63d62c5
commit 5d8cedb
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/package/etc/conf.d/filters/checkpoint/splunk.conf b/package/etc/conf.d/filters/checkpoint/splunk.conf
@@ -1,8 +1,8 @@
 filter f_checkpoint_splunk {
     match('\|(?:origin_sic_name|originsicname)\=[cC][nN]|\|product\=SmartConsole\|' value("MSG") type("pcre")) or
     match('\|(?:origin_sic_name|originsicname)\=[cC][nN]|\|product\=SmartConsole\|' value("LEGACY_MSGHDR") type("pcre")) or
-    match('|product\=Syslog\|ifdir=inbound\|loguid\=' value("MSG") type("pcre")) or
-    match('|product\=Syslog\|ifdir=inbound\|loguid\=' value("LEGACY_MSGHDR") type("pcre"));
+    match('*|product=Syslog|ifdir=inbound|loguid=*' value("MSG") type("glob")) or
+    match('*|product=Syslog|ifdir=inbound|loguid=*' value("LEGACY_MSGHDR") type("glob"));
 };
 
 filter f_checkpoint_splunk_alerts {