fix: set default truncate for Entra ID audit

Addresses #64
splunk · Jul 28, 2024 · f50b912 · f50b912
1 parent 4f7aba4
commit f50b912
Showing 1 changed file with 3 additions and 0 deletions.
diff --git a/package/default/props.conf b/package/default/props.conf
@@ -105,13 +105,16 @@ TIME_PREFIX = \"activityDateTime\"\:\s*\"
 MAX_TIMESTAMP_LOOKAHEAD = 30
 KV_MODE = json
 FIELDALIAS-activityDate = activityDateTime AS activityDate
+TRUNCATE = 0
 
 [azure:aad:audit]
 SHOULD_LINEMERGE = 0
 TIME_PREFIX = \"activityDateTime\"\:\s*\"
 MAX_TIMESTAMP_LOOKAHEAD = 30
 KV_MODE = json
 FIELDALIAS-azure_aad_audit_activityDate = activityDateTime AS activityDate
+TRUNCATE = 0
+
 ####################
 # Metrics
 ####################