diff --git a/package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl b/package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl index 011f670..cb9ed87 100644 --- a/package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl @@ -28,7 +28,7 @@ log { } else { rewrite { r_set_splunk_dest_default(sourcetype("sc4s:fallback"), index("main") ); - set("$(template ${fields.sc4s_template} $(template t_JSON))" value("MSG")); + set("$(template ${.splunk.sc4s_template} $(template t_JSON))" value("MSG")); }; parser { p_add_context_splunk(key("sc4s_fallback"));