diff --git a/deployment-apps/Splunk_TA_linky/local/props.conf b/deployment-apps/Splunk_TA_linky/local/props.conf index a1c08dce..176c9303 100644 --- a/deployment-apps/Splunk_TA_linky/local/props.conf +++ b/deployment-apps/Splunk_TA_linky/local/props.conf @@ -1,4 +1,6 @@ -[json] +[_json] KV_MODE = json TRANSFORMS-extract_json = extract_json_fields +TRANSFORMS-rename_date = rename_field_date +TRANSFORMS-rename_value = rename_field_value TRUNCATE = 0 \ No newline at end of file diff --git a/deployment-apps/Splunk_TA_linky/local/transforms.conf b/deployment-apps/Splunk_TA_linky/local/transforms.conf index 27a84fd6..dae93efe 100644 --- a/deployment-apps/Splunk_TA_linky/local/transforms.conf +++ b/deployment-apps/Splunk_TA_linky/local/transforms.conf @@ -1,4 +1,10 @@ [extract_json_fields] REGEX = \"(?[^\"]+)\":\s?\"(?[^\"]+)\" FORMAT = $1::$2 -WRITE_META = true \ No newline at end of file +WRITE_META = true + +[rename_field_date] +REGEX = interval_reading\{\}\.date=(?P[^\s]+) + +[rename_field_value] +REGEX = interval_reading\{\}\.value=(?P[^\s]+) \ No newline at end of file