[filtermod] LEEF correct format string for SOURCE:: (#647)

* [filtermod] LEEF correct format string for SOURCE:: * Update lp-log_extended_event_format.conf.tmpl
CSVD · Aug 21, 2020 · fb4c24d · fb4c24d
1 parent 69db811
commit fb4c24d
Showing 1 changed file with 2 additions and 2 deletions.
diff --git a/package/etc/conf.d/log_paths/lp-log_extended_event_format.conf.tmpl b/package/etc/conf.d/log_paths/lp-log_extended_event_format.conf.tmpl
@@ -82,8 +82,8 @@ class leef_kv(object):
                 log_message['.splunk.sourcetype'] = f"LEEF:{lv}"
             else:
                 log_message['.splunk.sourcetype'] = f"LEEF:{lv}:{hex_sep}"
-            log_message['.splunk.source'] = f"{structure[2]}:{structure[3]}"
-            log_message['fields.sc4s_vendor_product'] = f"{structure[2]}:{structure[3]}"
+            log_message['.splunk.source'] = f"{structure[1]}:{structure[2]}"
+            log_message['fields.sc4s_vendor_product'] = f"{structure[1]}:{structure[2]}"
 
             pairs = event.split(separator)
             for p in pairs: