From bbc5201b9b105d71795f703ec146c6c2aeaaebb6 Mon Sep 17 00:00:00 2001 From: rfaircloth-splunk Date: Mon, 15 Jun 2020 16:16:29 -0400 Subject: [PATCH] Update splunkfields.conf.tmpl --- package/etc/conf.d/conflib/_splunk/splunkfields.conf.tmpl | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/package/etc/conf.d/conflib/_splunk/splunkfields.conf.tmpl b/package/etc/conf.d/conflib/_splunk/splunkfields.conf.tmpl index 2d0b30c..8f94271 100644 --- a/package/etc/conf.d/conflib/_splunk/splunkfields.conf.tmpl +++ b/package/etc/conf.d/conflib/_splunk/splunkfields.conf.tmpl @@ -37,12 +37,12 @@ rewrite r_set_splunk_default { #overridden by user defined values block rewrite r_set_splunk_dest_default( #While the following is not used it remains to prevent breaking changes in content - index('') + index('{{- getenv "SC4S_DEST_SPLUNK_HEC_FALLBACK_INDEX" }}') source("${.splunk.source}") sourcetype() template(`splunk-template`) ) { - set("{{- getenv "SC4S_DEST_SPLUNK_HEC_FALLBACK_INDEX" }}", value(".splunk.index")); + set("`index`", value(".splunk.index")); set("`source`", value(".splunk.source")); set("`sourcetype`", value(".splunk.sourcetype")); };