Revert "update"

This reverts commit cf0d242268.
2 years ago · 538676b17a
parent cf0d242268
commit 538676b17a
2 changed files with 5 additions and 6 deletions
--- a/deployment-apps/Splunk_TA_linky/local/props.conf
+++ b/deployment-apps/Splunk_TA_linky/local/props.conf
@ -1,5 +1,4 @@
 [_json]
 KV_MODE = json
-SHOULD_LINEMERGE = false
+TRANSFORMS-extract_json = extract_json_fields
 TRUNCATE = 0
-REPORT-extract_fields = extract_fields
--- a/deployment-apps/Splunk_TA_linky/local/transforms.conf
+++ b/deployment-apps/Splunk_TA_linky/local/transforms.conf
@ -1,4 +1,4 @@
-[extract_fields]
-REGEX = (?s)(?<=\{).*?(\})
-FORMAT = _json
+[extract_json_fields]
+REGEX = \"(?<field_name>[^\"]+)\":\s?\"(?<field_value>[^\"]+)\"
+FORMAT = $1::$2
 WRITE_META = true