update-TA

deployment-apps/Splunk_TA_api-renault/local/props.conf

@@ -1,2 +1,5 @@
-[_json]
-TRANSFORMS-set=json_transform
+#[_json]
+#TRANSFORMS-set=json_transform
+
+[syslog]
+SEDCMD-remove-dashes = s/-//g

deployment-apps/Splunk_TA_api-renault/local/transforms.conf

@@ -1,3 +1,8 @@
-[extract-fields]
-REGEX = \{\"(?<json_data>[^\"]+)\"\}
-FORMAT = $1::$json_data
+#[extract-fields]
+#REGEX = \{\"(?<json_data>[^\"]+)\"\}
+#FORMAT = $1::$json_data
+
+[custom-fields]
+REGEX = ^(\S+)\s+(\S+)\s+(\S+)\s+(\S+)
+FORMAT = Registration::$1 Brand::$2 Model::$3 VIN::$4
+