From 05f030014c00667f26a8cf8ba7136ef7d3518c09 Mon Sep 17 00:00:00 2001
From: admingit <jocelyn.pamphile@businessdecision.com>
Date: Thu, 4 Jan 2024 09:19:53 +0100
Subject: [PATCH] modification de champ

---
 deployment-apps/Splunk_TA_linky/local/props.conf      | 4 +++-
 deployment-apps/Splunk_TA_linky/local/transforms.conf | 8 +++++++-
 2 files changed, 10 insertions(+), 2 deletions(-)

diff --git a/deployment-apps/Splunk_TA_linky/local/props.conf b/deployment-apps/Splunk_TA_linky/local/props.conf
index a1c08dce..176c9303 100644
--- a/deployment-apps/Splunk_TA_linky/local/props.conf
+++ b/deployment-apps/Splunk_TA_linky/local/props.conf
@@ -1,4 +1,6 @@
-[json]
+[_json]
 KV_MODE = json
 TRANSFORMS-extract_json = extract_json_fields
+TRANSFORMS-rename_date = rename_field_date
+TRANSFORMS-rename_value = rename_field_value
 TRUNCATE = 0
\ No newline at end of file
diff --git a/deployment-apps/Splunk_TA_linky/local/transforms.conf b/deployment-apps/Splunk_TA_linky/local/transforms.conf
index 27a84fd6..dae93efe 100644
--- a/deployment-apps/Splunk_TA_linky/local/transforms.conf
+++ b/deployment-apps/Splunk_TA_linky/local/transforms.conf
@@ -1,4 +1,10 @@
 [extract_json_fields]
 REGEX = \"(?<field_name>[^\"]+)\":\s?\"(?<field_value>[^\"]+)\"
 FORMAT = $1::$2
-WRITE_META = true
\ No newline at end of file
+WRITE_META = true
+
+[rename_field_date]
+REGEX = interval_reading\{\}\.date=(?P<interval_reading\.date>[^\s]+)
+
+[rename_field_value]
+REGEX = interval_reading\{\}\.value=(?P<interval_reading\.value>[^\s]+)
\ No newline at end of file