the field name requires single quotes (') because it contains a perio…

…d (.)
northben · Oct 2, 2020 · 182b0a5 · 182b0a5
1 parent 92952d7
commit 182b0a5
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/TA-sentinelone_cloud/default/props.conf b/TA-sentinelone_cloud/default/props.conf
@@ -84,7 +84,7 @@ EVAL-object_attrs = untable name key value
 EVAL-object_category = activityType
 EVAL-object_id = id
 EVAL-object_path = if( secondaryDescription == "null","",  secondaryDescription)
-EVAL-src_host = if(isnull(data.computerName)," ", data.computerName)
+EVAL-src_host = if(isnull('data.computerName')," ", 'data.computerName')
 EVAL-src_name = siteName.data.computerName
 EVAL-src_user = if(isnull(data.username), "sentinelone", data.username)
 EVAL-status = if(match(primaryDescription,"(?i)\s(fail|failed|failure|error|err|unauthorized)\s") ,"failure" ,"success")