diff --git a/macros/sysmon.yml b/macros/sysmon.yml
index fb5503662c..17fdbd53e0 100644
--- a/macros/sysmon.yml
+++ b/macros/sysmon.yml
@@ -1,4 +1,4 @@
-definition: sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational
+definition: sourcetype=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=XmlWinEventLog:Microsoft-Windows-Sysmon/Operational OR source=Syslog:Linux-Sysmon/Operational
 description: customer specific splunk configurations(eg- index, source, sourcetype).
   Replace the macro definition with configurations for your Splunk Environmnent.
 name: sysmon