-
Notifications
You must be signed in to change notification settings - Fork 111
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
feat: Netapp ontap audit ems support (#2639)
* chore(deps): update dependency mkdocs-material to v9.5.42 (#2624) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * chore(deps): update splunk/addonfactory-test-matrix-action action to v2.1.9 (#2620) Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> * fix: fix CISE_Alarm messages parsing (#2609) * fix: improve SC4S Dashboard performance (#2592) * docs: Removed reference of Cisco eStreamer for Splunk app from ASA/FTD doc (#2629) * docs: Removed reference of Cisco eStreamer for Splunk app * feat: Added support for ems logs and fixed the existing classification * Updated the documentation and made some changes in the parser * Updating the test file such that all the test cases are passing * Added support in sc4s lite * docs: Added the migration precaution in the upgrade.md file * Removed an addionally created test file and merged my changes to the existing one * Updated the code to maintain the backward compatibility * Updated the test-container workflow to set the newly introduced environment variable's value to 'yes' and made some changes in the test vps parser. --------- Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com> Co-authored-by: wojtekzyla <[email protected]> Co-authored-by: mstopa-splunk <[email protected]>
- Loading branch information
4 people
authored
Dec 9, 2024
1 parent
85bfb8f
commit 56f9bf4
Showing
10 changed files
with
216 additions
and
11 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
55 changes: 55 additions & 0 deletions
55
package/etc/conf.d/conflib/netsource/app-netsource-netapp_ontap.conf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| block parser app-netsource-netapp_ontap() { | ||
| channel { | ||
| rewrite { | ||
| r_set_splunk_dest_default( | ||
| index("infraops") | ||
| vendor("netapp") | ||
| product("ontap") | ||
| ); | ||
| }; | ||
|
|
||
| if { | ||
| parser { | ||
| regexp-parser( | ||
| prefix(".tmp.") | ||
| patterns('^[A-Za-z0-9\-\_\.]+: [0-9a-f]+\.[0-9a-f]+ [0-9a-f]+ [A-Z][a-z][a-z] (?<timestamp>[A-Z][a-z][a-z] \d\d \d\d\d\d \d\d:\d\d:\d\d [+-]?\d{1,2}:\d\d)') | ||
| ); | ||
| date-parser-nofilter( | ||
| format( | ||
| '%b %d %Y %H:%M:%S %z', | ||
| ) | ||
| template("${.tmp.timestamp}") | ||
| ); | ||
| }; | ||
|
|
||
| rewrite { | ||
| set('$PROGRAM: $MESSAGE', value(MESSAGE)); | ||
| set('$PROGRAM', value(HOST)); | ||
| unset(value(PROGRAM)); | ||
| }; | ||
|
|
||
| rewrite { | ||
| r_set_splunk_dest_update_v2( | ||
| sourcetype('netapp:ontap:audit') | ||
| class('audit') | ||
| ); | ||
| }; | ||
| } else { | ||
| rewrite { | ||
| r_set_splunk_dest_update_v2( | ||
| sourcetype('netapp:ontap:ems') | ||
| class('ems') | ||
| ); | ||
| }; | ||
| }; | ||
| }; | ||
| }; | ||
|
|
||
| application app-netsource-netapp_ontap[sc4s-network-source] { | ||
| filter { | ||
| match("netapp", value('.netsource.sc4s_vendor'), type(string)) | ||
| and match("ontap", value('.netsource.sc4s_product'), type(string)) | ||
| and "`SC4S_NETAPP_ONTAP_NEW_FORMAT`" eq "yes" | ||
| }; | ||
| parser { app-netsource-netapp_ontap(); }; | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,15 @@ | ||
| application app-vps-test-netapp_ontap[sc4s-vps] { | ||
| filter { | ||
| host("netapp-ontap-" type(string) flags(prefix)) | ||
| or ( | ||
| message("netapp-ontap-" type(string) flags(prefix)) | ||
| and program("netapp-ontap-" type(string) flags(prefix)) | ||
| ) | ||
| }; | ||
| parser { | ||
| p_set_netsource_fields( | ||
| vendor('netapp') | ||
| product('ontap') | ||
| ); | ||
| }; | ||
| }; |
55 changes: 55 additions & 0 deletions
55
package/lite/etc/addons/netapp/app-netsource-netapp_ontap.conf
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,55 @@ | ||
| block parser app-netsource-netapp_ontap() { | ||
| channel { | ||
| rewrite { | ||
| r_set_splunk_dest_default( | ||
| index("infraops") | ||
| vendor("netapp") | ||
| product("ontap") | ||
| ); | ||
| }; | ||
|
|
||
| if { | ||
| parser { | ||
| regexp-parser( | ||
| prefix(".tmp.") | ||
| patterns('^[A-Za-z0-9\-\_\.]+: [0-9a-f]+\.[0-9a-f]+ [0-9a-f]+ [A-Z][a-z][a-z] (?<timestamp>[A-Z][a-z][a-z] \d\d \d\d\d\d \d\d:\d\d:\d\d [+-]?\d{1,2}:\d\d)') | ||
| ); | ||
| date-parser-nofilter( | ||
| format( | ||
| '%b %d %Y %H:%M:%S %z', | ||
| ) | ||
| template("${.tmp.timestamp}") | ||
| ); | ||
| }; | ||
|
|
||
| rewrite { | ||
| set('$PROGRAM: $MESSAGE', value(MESSAGE)); | ||
| set('$PROGRAM', value(HOST)); | ||
| unset(value(PROGRAM)); | ||
| }; | ||
|
|
||
| rewrite { | ||
| r_set_splunk_dest_update_v2( | ||
| sourcetype('netapp:ontap:audit') | ||
| class('audit') | ||
| ); | ||
| }; | ||
| } else { | ||
| rewrite { | ||
| r_set_splunk_dest_update_v2( | ||
| sourcetype('netapp:ontap:ems') | ||
| class('ems') | ||
| ); | ||
| }; | ||
| }; | ||
| }; | ||
| }; | ||
|
|
||
| application app-netsource-netapp_ontap[sc4s-network-source] { | ||
| filter { | ||
| match("netapp", value('.netsource.sc4s_vendor'), type(string)) | ||
| and match("ontap", value('.netsource.sc4s_product'), type(string)) | ||
| and "`SC4S_NETAPP_ONTAP_NEW_FORMAT`" eq "yes" | ||
| }; | ||
| parser { app-netsource-netapp_ontap(); }; | ||
| }; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters