addTA

3 years ago · 09c46e6f1f
parent 4263e3e091
commit 09c46e6f1f
2 changed files with 5 additions and 0 deletions
--- a/deployment-apps/Splunk_TA_api-renault/local/props.conf
+++ b/deployment-apps/Splunk_TA_api-renault/local/props.conf
@ -0,0 +1,2 @@
+[_json]
+TRANSFORMS-set=json_transform
--- a/deployment-apps/Splunk_TA_api-renault/local/transforms.conf
+++ b/deployment-apps/Splunk_TA_api-renault/local/transforms.conf
@ -0,0 +1,3 @@
+[extract-fields]
+REGEX = \{\"(?<json_data>[^\"]+)\"\}
+FORMAT = $1::$json_data