diff --git a/deployment-apps/02-Linky_forwarders_inputs/local/inputs.conf b/deployment-apps/02-Linky_forwarders_inputs/local/inputs.conf index 69d8afbd..4a772c03 100644 --- a/deployment-apps/02-Linky_forwarders_inputs/local/inputs.conf +++ b/deployment-apps/02-Linky_forwarders_inputs/local/inputs.conf @@ -1,7 +1,7 @@ [monitor:///var/rsyslog/linky/*.json] disabled = 0 index = idx_linky -sourcetype = _json +sourcetype = json #[monitor:///var/rsyslog/*/linky/*.csv] #disabled = false diff --git a/deployment-apps/Splunk_TA_linky/local/props.conf b/deployment-apps/Splunk_TA_linky/local/props.conf index bebe8e71..a1c08dce 100644 --- a/deployment-apps/Splunk_TA_linky/local/props.conf +++ b/deployment-apps/Splunk_TA_linky/local/props.conf @@ -1,4 +1,4 @@ -[_json] +[json] KV_MODE = json TRANSFORMS-extract_json = extract_json_fields TRUNCATE = 0 \ No newline at end of file