From b6397f53ea4a1aa9ed5b6279733c3756b2b59741 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Tue, 17 Dec 2019 11:21:22 -0500 Subject: [PATCH] Update p_zz_fallback.conf.tmpl --- package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl b/package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl index 11f90fa..011f670 100644 --- a/package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl +++ b/package/etc/conf.d/log_paths/p_zz_fallback.conf.tmpl @@ -4,7 +4,7 @@ log { if { filter(f_is_rfc5424_strict); rewrite { - r_set_splunk_dest_default(sourcetype("sc4s:fallback"), index("main"), template("t_JSON")); + r_set_splunk_dest_default(sourcetype("sc4s:fallback"), index("main")); set("$(template ${.splunk.sc4s_template} $(template t_JSON))" value("MSG")); }; parser { @@ -27,7 +27,7 @@ log { } else { rewrite { - r_set_splunk_dest_default(sourcetype("sc4s:fallback"), index("main"), template("t_JSON")); + r_set_splunk_dest_default(sourcetype("sc4s:fallback"), index("main") ); set("$(template ${fields.sc4s_template} $(template t_JSON))" value("MSG")); }; parser {