Merge pull request #402 from splunk/fix/checkpointnest

Fix/checkpointnest
CSVD · Apr 8, 2020 · 742f5f8 · 742f5f8
2 parents 63d62c5 + 5d8cedb
commit 742f5f8
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/package/etc/conf.d/filters/checkpoint/splunk.conf b/package/etc/conf.d/filters/checkpoint/splunk.conf
@@ -1,8 +1,8 @@
 filter f_checkpoint_splunk {
     match('\|(?:origin_sic_name|originsicname)\=[cC][nN]|\|product\=SmartConsole\|' value("MSG") type("pcre")) or
     match('\|(?:origin_sic_name|originsicname)\=[cC][nN]|\|product\=SmartConsole\|' value("LEGACY_MSGHDR") type("pcre")) or
-    match('|product\=Syslog\|ifdir=inbound\|loguid\=' value("MSG") type("pcre")) or
-    match('|product\=Syslog\|ifdir=inbound\|loguid\=' value("LEGACY_MSGHDR") type("pcre"));
+    match('*|product=Syslog|ifdir=inbound|loguid=*' value("MSG") type("glob")) or
+    match('*|product=Syslog|ifdir=inbound|loguid=*' value("LEGACY_MSGHDR") type("glob"));
 };
 
 filter f_checkpoint_splunk_alerts {