From 1fb70ddd9ad59840eaab2285a40f408e30b52864 Mon Sep 17 00:00:00 2001 From: admingit Date: Fri, 8 Sep 2023 12:28:12 +0200 Subject: [PATCH] update --- .../02-M-TIC_fortigate_forwarders_inputs/local/inputs.conf | 2 +- deployment-apps/Splunk_TA_fortinet_fortigate/default/props.conf | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/deployment-apps/02-M-TIC_fortigate_forwarders_inputs/local/inputs.conf b/deployment-apps/02-M-TIC_fortigate_forwarders_inputs/local/inputs.conf index a94ccf2d..79858735 100644 --- a/deployment-apps/02-M-TIC_fortigate_forwarders_inputs/local/inputs.conf +++ b/deployment-apps/02-M-TIC_fortigate_forwarders_inputs/local/inputs.conf @@ -1,4 +1,4 @@ [monitor:///var/rsyslog/*/fortigate/*/*/*.log] disabled = false index = idx_m-tic_fortigate -sourcetype = fortigate \ No newline at end of file +sourcetype = fortigate_logs \ No newline at end of file diff --git a/deployment-apps/Splunk_TA_fortinet_fortigate/default/props.conf b/deployment-apps/Splunk_TA_fortinet_fortigate/default/props.conf index 31ae4a41..72e4d266 100644 --- a/deployment-apps/Splunk_TA_fortinet_fortigate/default/props.conf +++ b/deployment-apps/Splunk_TA_fortinet_fortigate/default/props.conf @@ -1,4 +1,4 @@ -[fortigate] +[fortigate_logs] TRANSFORMS-force_sourcetype_fortigate = force_sourcetype_fortigate SHOULD_LINEMERGE = false EVENT_BREAKER_ENABLE = true