Merge pull request #275 from splunk/fix/palo_log_path

Fix output template for Palo Alto log path
CSVD · Jan 15, 2020 · c86a6d5 · c86a6d5
2 parents 515f9dc + db1f326
commit c86a6d5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/package/etc/conf.d/log_paths/p_rfc3164-paloalto_panos.conf.tmpl b/package/etc/conf.d/log_paths/p_rfc3164-paloalto_panos.conf.tmpl
@@ -77,7 +77,7 @@ log {
     };
 
     parser (compliance_meta_by_source);
-    rewrite { set("$(template ${.splunk.sc4s_template} $(template t_hdr_msg))" value("MSG")); };
+    rewrite { set("$(template ${.splunk.sc4s_template} $(template t_msg_only))" value("MSG")); };
 
 {{- if or (conv.ToBool (getenv "SC4S_DEST_SPLUNK_HEC_GLOBAL" "yes")) (conv.ToBool (getenv "SC4S_DEST_PALOALTO_PANOS_HEC" "no")) }}
     destination(d_hec);