From 607b7a1e37d6fc3a3e49d0625df16ff3c73f92ed Mon Sep 17 00:00:00 2001 From: Lou Stella Date: Mon, 6 Jun 2022 14:55:56 -0500 Subject: [PATCH] Updated macro to not rely on field extraction --- macros/splunkd_failed_auths.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/macros/splunkd_failed_auths.yml b/macros/splunkd_failed_auths.yml index 54a9027bb5..2cd71209e8 100644 --- a/macros/splunkd_failed_auths.yml +++ b/macros/splunkd_failed_auths.yml @@ -1,4 +1,4 @@ -definition: index=_audit action="login attempt" info="failed" +definition: index=_audit "action=login attempt" "info=failed" description: customer specific splunk configurations(eg- index, source, sourcetype). Replace the macro definition with configurations for your Splunk Environmnent. name: splunkd_failed_auths \ No newline at end of file