addTAlinky

2 years ago · 2f87a78c5a
parent 7ed1eb1a79
commit 2f87a78c5a
3 changed files with 8 additions and 0 deletions
--- a/deployment-apps/Splunk_TA_linky/local/app.conf
+++ b/deployment-apps/Splunk_TA_linky/local/app.conf
@ -0,0 +1 @@
+# Autogenerated file 
--- a/deployment-apps/Splunk_TA_linky/local/props.conf
+++ b/deployment-apps/Splunk_TA_linky/local/props.conf
@ -0,0 +1,3 @@
+[json]
+KV_MODE = json
+TRANSFORMS-extract_json = extract_json_fields
--- a/deployment-apps/Splunk_TA_linky/local/transforms.conf
+++ b/deployment-apps/Splunk_TA_linky/local/transforms.conf
@ -0,0 +1,4 @@
+[extract_json_fields]
+REGEX = \"(?<field_name>[^\"]+)\":\s?\"(?<field_value>[^\"]+)\"
+FORMAT = $1::$2
+WRITE_META = true