From 76d5bec0e6e52f9660125831023a9e5e89acd64d Mon Sep 17 00:00:00 2001
From: rfaircloth-splunk <rfaircloth@splunk.com>
Date: Fri, 20 Dec 2019 15:27:00 -0500
Subject: [PATCH] Update p_zz_fallback.conf.tmpl

---
 package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl b/package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl
index 22fc97b..220916a 100644
--- a/package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl
+++ b/package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl
@@ -5,7 +5,7 @@ log {
         filter(f_is_rfc5424_strict);
         rewrite {
             r_set_splunk_dest_default(sourcetype("sc4s:fallback"), index("main"));
-            set("$(template ${.splunk.sc4s_template} $(template t_JSON))" value("MSG"));
+            set("$(template ${.splunk.sc4s_template} $(template t_JSON_5424))" value("MSG"));
             unset(value("RAWMSG"));
         };
         parser {