diff --git a/.DS_Store b/.DS_Store new file mode 100644 index 00000000..116d269d Binary files /dev/null and b/.DS_Store differ diff --git a/deployment-apps/.DS_Store b/deployment-apps/.DS_Store new file mode 100644 index 00000000..c0f92835 Binary files /dev/null and b/deployment-apps/.DS_Store differ diff --git a/deployment-apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/4_2_0/lib/python3.8/site-packages/.DS_Store b/deployment-apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/4_2_0/lib/python3.8/site-packages/.DS_Store new file mode 100644 index 00000000..312b81f9 Binary files /dev/null and b/deployment-apps/Splunk_SA_Scientific_Python_linux_x86_64/bin/linux_x86_64/4_2_0/lib/python3.8/site-packages/.DS_Store differ diff --git a/deployment-apps/Splunk_TA_api-renault/local/props.conf b/deployment-apps/Splunk_TA_api-renault/local/props.conf index 50da2beb..fd45a87d 100644 --- a/deployment-apps/Splunk_TA_api-renault/local/props.conf +++ b/deployment-apps/Splunk_TA_api-renault/local/props.conf @@ -1,2 +1,5 @@ -[_json] -TRANSFORMS-set=json_transform \ No newline at end of file +#[_json] +#TRANSFORMS-set=json_transform + +[syslog] +SEDCMD-remove-dashes = s/-//g \ No newline at end of file diff --git a/deployment-apps/Splunk_TA_api-renault/local/transforms.conf b/deployment-apps/Splunk_TA_api-renault/local/transforms.conf index 74643a3e..b4f01683 100644 --- a/deployment-apps/Splunk_TA_api-renault/local/transforms.conf +++ b/deployment-apps/Splunk_TA_api-renault/local/transforms.conf @@ -1,3 +1,8 @@ -[extract-fields] -REGEX = \{\"(?[^\"]+)\"\} -FORMAT = $1::$json_data \ No newline at end of file +#[extract-fields] +#REGEX = \{\"(?[^\"]+)\"\} +#FORMAT = $1::$json_data + +[custom-fields] +REGEX = ^(\S+)\s+(\S+)\s+(\S+)\s+(\S+) +FORMAT = Registration::$1 Brand::$2 Model::$3 VIN::$4 +