diff --git a/deployment-apps/Splunk_TA_linky/local/props.conf b/deployment-apps/Splunk_TA_linky/local/props.conf index 176c9303..6a79121d 100644 --- a/deployment-apps/Splunk_TA_linky/local/props.conf +++ b/deployment-apps/Splunk_TA_linky/local/props.conf @@ -1,6 +1,6 @@ [_json] -KV_MODE = json -TRANSFORMS-extract_json = extract_json_fields +#KV_MODE = json +#TRANSFORMS-extract_json = extract_json_fields TRANSFORMS-rename_date = rename_field_date TRANSFORMS-rename_value = rename_field_value -TRUNCATE = 0 \ No newline at end of file +#TRUNCATE = 0 \ No newline at end of file diff --git a/deployment-apps/Splunk_TA_linky/local/transforms.conf b/deployment-apps/Splunk_TA_linky/local/transforms.conf index dae93efe..9b07c1ae 100644 --- a/deployment-apps/Splunk_TA_linky/local/transforms.conf +++ b/deployment-apps/Splunk_TA_linky/local/transforms.conf @@ -1,7 +1,7 @@ -[extract_json_fields] -REGEX = \"(?[^\"]+)\":\s?\"(?[^\"]+)\" -FORMAT = $1::$2 -WRITE_META = true +#[extract_json_fields] +#REGEX = \"(?[^\"]+)\":\s?\"(?[^\"]+)\" +#FORMAT = $1::$2 +#WRITE_META = true [rename_field_date] REGEX = interval_reading\{\}\.date=(?P[^\s]+)