[filtermod] Fix issue with cp nested syslog (#614)

CSVD · Aug 7, 2020 · b4f2620 · b4f2620
1 parent 8f7fa8d
commit b4f2620
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/package/etc/conf.d/filters/checkpoint/splunk.conf b/package/etc/conf.d/filters/checkpoint/splunk.conf
@@ -1,8 +1,8 @@
 filter f_checkpoint_splunk {
     match('\|(?:origin_sic_name|originsicname)\=[cC][nN]|\|product\=SmartConsole\|' value("MSG") type("pcre")) or
     match('\|(?:origin_sic_name|originsicname)\=[cC][nN]|\|product\=SmartConsole\|' value("LEGACY_MSGHDR") type("pcre")) or
-    match('|product=Syslog|ifdir=inbound|loguid=' value("MSG") type("glob")) or
-    match('|product=Syslog|ifdir=inbound|loguid=' value("LEGACY_MSGHDR") type("glob"));
+    match('\|product=Syslog\|ifdir=inbound\|loguid=' value("MSG")) or
+    match('\|product=Syslog\|ifdir=inbound\|loguid=' value("LEGACY_MSGHDR"));
 };
 
 filter f_checkpoint_splunk_alerts {