From 2823f140d2701083ad0a8548d09435d8c3c56a9d Mon Sep 17 00:00:00 2001
From: Chris Long <clong@cl0ng.com>
Date: Mon, 1 Jun 2020 21:47:32 -0700
Subject: [PATCH] Update props.conf

---
 Vagrant/resources/splunk_server/props.conf | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/Vagrant/resources/splunk_server/props.conf b/Vagrant/resources/splunk_server/props.conf
index bc6dcab..d4bd90d 100644
--- a/Vagrant/resources/splunk_server/props.conf
+++ b/Vagrant/resources/splunk_server/props.conf
@@ -21,7 +21,7 @@ TIME_FORMAT = %s
 TRUNCATE = 0
 
 [osquery:status]
-TRANSFORMS-null = setnull
+TRANSFORMS-null = osquery_status_filter
 
 [WinEventLog]
-TRANSFORMS-null = autoruns_wineventlog_null
\ No newline at end of file
+TRANSFORMS-null = autoruns_wineventlog_null