Update splunkfields.conf.tmpl

CSVD · Jun 15, 2020 · bbc5201 · bbc5201
1 parent 3f8e58f
commit bbc5201
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/package/etc/conf.d/conflib/_splunk/splunkfields.conf.tmpl b/package/etc/conf.d/conflib/_splunk/splunkfields.conf.tmpl
@@ -37,12 +37,12 @@ rewrite r_set_splunk_default {
 #overridden by user defined values
 block rewrite r_set_splunk_dest_default(
                               #While the following is not used it remains to prevent breaking changes in content
-                              index('')
+                              index('{{- getenv "SC4S_DEST_SPLUNK_HEC_FALLBACK_INDEX" }}')
                               source("${.splunk.source}")                              
                               sourcetype()
                               template(`splunk-template`)
                            ) {
-      set("{{- getenv "SC4S_DEST_SPLUNK_HEC_FALLBACK_INDEX" }}", value(".splunk.index"));
+      set("`index`", value(".splunk.index"));
       set("`source`", value(".splunk.source"));
       set("`sourcetype`", value(".splunk.sourcetype"));
 };