fix: postfilter automatic assignment

splunk · Sep 20, 2023 · 45dc1e5 · 45dc1e5
1 parent 6a051b4
commit 45dc1e5
Show file tree

Hide file tree

Showing 5 changed files with 3 additions and 8 deletions.
diff --git a/package/etc/conf.d/conflib/post-filter/app-postfilter-cisco_acs.conf b/package/etc/conf.d/conflib/post-filter/app-postfilter-cisco_acs.conf
@@ -39,7 +39,6 @@ block parser app-postfilter-cisco_acs() {
                     inherit-mode(context)
                 )
                 timeout(10)
-                persist-name("grouping-by-app-postfilter-cisco_acs")
             );
         };
 

diff --git a/package/etc/conf.d/conflib/post-filter/app-postfilter-cisco_ise.conf b/package/etc/conf.d/conflib/post-filter/app-postfilter-cisco_ise.conf
@@ -23,7 +23,7 @@ block parser app-postfilter-cisco_ise() {
 
         parser{
             grouping-by(
-                scope(program)
+                scope(host)
                 key("${.values.serial}")
                 trigger("$(context-length)" >= "${.values.num}")
                 sort-key("${.values.seq}")
@@ -38,7 +38,6 @@ block parser app-postfilter-cisco_ise() {
                     inherit-mode(context)
                 )
                 timeout(10)
-                persist-name("grouping-by-app-postfilter-cisco_ise")
             );
         };
 

diff --git a/package/etc/conf.d/conflib/post-filter/app-postfilter-vmware_vsphere_invalidmultiline.conf b/package/etc/conf.d/conflib/post-filter/app-postfilter-vmware_vsphere_invalidmultiline.conf
@@ -28,7 +28,6 @@ block parser app-postfilter-vmware_vsphere_invalidmultiline() {
                     inherit-mode(context)
                 )
                 timeout(2)
-                persist-name("grouping-by-app-postfilter-vmware_vsphere_invalidmultiline")
             );
         };
 

diff --git a/package/etc/conf.d/conflib/post-filter/app-postfilter-vmware_vsphere_sdrsInjector.conf b/package/etc/conf.d/conflib/post-filter/app-postfilter-vmware_vsphere_sdrsInjector.conf
@@ -10,7 +10,7 @@ block parser app-postfilter-vmware_vsphere_sdrsInjector() {
         parser{
             grouping-by(
                 scope(program)
-                key('$SOURCEIP')
+                key('$FULLHOST')
                 aggregate(
                     tags("agg")
                     value("MESSAGE" "$(implode '\n' $(list-slice 0:-1 $(context-values ${MESSAGE})))")
@@ -28,7 +28,6 @@ block parser app-postfilter-vmware_vsphere_sdrsInjector() {
                     inherit-mode(context)
                 )
                 timeout(2)
-                persist-name("grouping-by-app-postfilter-vmware_vsphere_sdrsInjector")
             );
         };
 

diff --git a/package/etc/conf.d/conflib/post-filter/app-postfilter-vmware_vsphere_storageRM.conf b/package/etc/conf.d/conflib/post-filter/app-postfilter-vmware_vsphere_storageRM.conf
@@ -10,7 +10,7 @@ block parser app-postfilter-vmware_vsphere_storageRM() {
         parser{
             grouping-by(
                 scope(program)
-                key('$SOURCEIP')
+                key('$FULLHOST_FROM')
                 trigger(message('datastoreSlopeUS\[5\]'))
                 aggregate(
                     tags("agg")
@@ -29,7 +29,6 @@ block parser app-postfilter-vmware_vsphere_storageRM() {
                     inherit-mode(context)
                 )
                 timeout(2)
-                persist-name("grouping-by-app-postfilter-vmware_vsphere_storageRM")
             );
         };