From 62d2592949006f0a32ea0330ac9f6719ee270fdb Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Fri, 29 May 2020 11:51:13 -0400
Subject: [PATCH] Update lp-vmware_vsphere.conf.tmpl

---
 .../etc/conf.d/log_paths/lp-vmware_vsphere.conf.tmpl  | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/package/etc/conf.d/log_paths/lp-vmware_vsphere.conf.tmpl b/package/etc/conf.d/log_paths/lp-vmware_vsphere.conf.tmpl
index b4764cd..2aeed34 100644
--- a/package/etc/conf.d/log_paths/lp-vmware_vsphere.conf.tmpl
+++ b/package/etc/conf.d/log_paths/lp-vmware_vsphere.conf.tmpl
@@ -47,6 +47,17 @@ log {
         parser (compliance_meta_by_source);
         rewrite { set("$(template ${.splunk.sc4s_template} $(template t_legacy_hdr_msg))" value("MSG")); };
     } elif {
+        filter(f_is_rfc5424_strict);
+        filter(f_vmware_vcenter);
+
+        rewrite {
+            set("vmware_vcenter", value("fields.sc4s_vendor_product"));
+            r_set_splunk_dest_default(sourcetype("vmware:vsphere:vcenter"), index("main"), source("program:${PROGRAM}"));
+        };
+        parser { p_add_context_splunk(key("vmware_vcenter")); };
+        parser (compliance_meta_by_source);
+        rewrite { set("$(template ${.splunk.sc4s_template} $(template t_JSON_5424))" value("MSG")); };    
+    } elif {
 
         filter(f_vmware_vcenter);