feat: support qumulo (#1365)

SFDC case 2854078

docs/sources/Qumulo/index.md

@@ -0,0 +1,48 @@
+# Vendor - Qumulo
+
+## Product - Storage
+
+| Ref               | Link                                                                    |
+|-------------------|-------------------------------------------------------------------------|
+| Splunk Add-on     | none                              |
+
+### Sourcetypes
+
+| sourcetype               | notes                                                            |
+|--------------------------|------------------------------------------------------------------|
+| qumulo:storage  | None                                                             |
+
+### Sourcetype and Index Configuration
+
+| key                        | sourcetype             | index          | notes         |
+|----------------------------|------------------------|----------------|---------------|
+| qumulo_storage         | qumulo:storage | infraops          | none          |
+
+### Filter type
+
+* MSG Parse: This filter parses message content
+
+### Setup and Configuration
+
+* Install the Splunk Add-on on the search head(s) for the user communities interested in this data source. If SC4S is exclusively used the addon is not required on the indexer.
+* Review and update the splunk_metadata.csv file and set the index as required.
+* Follow vendor configuration steps per referenced Product Manual
+
+### Options
+
+| Variable       | default        | description    |
+|----------------|----------------|----------------|
+| SC4S_LISTEN_QUMULO_STORAGE_TCP_PORT      | empty string      | Enable a UDP port for this specific vendor product using a comma-separated list of port numbers using legacy 3164 format|
+| SC4S_ARCHIVE_QUMULO_STORAGE | no | Enable archive to disk for this specific source |
+| SC4S_DEST_QUMULO_STORAGE_HEC | no | When Splunk HEC is disabled globally set to yes to enable this specific source | 
+
+### Verification
+
+Use the following search to validate events are present
+
+```
+index=<asconfigured> sourcetype=qumulo:storage* | stats count by host
+```
+
+Verify the timestamp and host values match as expected
+

mkdocs.yml

@@ -77,6 +77,7 @@ nav:
       - Polycom: sources/Polycom/index.md
       - Pulse: sources/Pulse/index.md
       - Proofpoint: sources/Proofpoint/index.md
+      - Qumulo: sources/Qumulo/index.md
       - Radware: sources/Radware/index.md
       - Raritan: sources/Raritan/index.md
       - Ricoh: sources/Ricoh/index.md

package/etc/conf.d/conflib/syslog/app-qumulo.conf

@@ -0,0 +1,20 @@
+block parser qumulo_storage-parser() {    
+ channel {
+        rewrite {
+            r_set_splunk_dest_default(
+                index("infraops")
+                sourcetype('qumulo:storage')
+                vendor_product("qumulo_storage")
+                template('t_msg_only')
+            );                         
+        };       
+
+
+   };
+};
+application qumulo_storage[sc4s-syslog] {
+	filter { 
+        program('qumulo');
+    };	
+    parser { qumulo_storage-parser(); };   
+};

tests/test_qumulo.py

@@ -0,0 +1,46 @@
+# Copyright 2019 Splunk, Inc.
+#
+# Use of this source code is governed by a BSD-2-clause-style
+# license that can be found in the LICENSE-BSD2 file or at
+# https://opensource.org/licenses/BSD-2-Clause
+
+import random
+from jinja2 import Environment
+
+from .sendmessage import *
+from .splunkutils import *
+from .timeutils import *
+
+env = Environment()
+
+# <14>1 2021-12-08T21:14:32.063248Z xxxxxx-1 qumulo - - - 127.0.0.1,"admin",api,fs_read_metadata,ok,2,"/",""
+def test_qumulo_storage(record_property, setup_wordlist, setup_splunk, setup_sc4s):
+    host = "{}-{}".format(random.choice(setup_wordlist), random.choice(setup_wordlist))
+
+    dt = datetime.datetime.now()
+    iso, bsd, time, date, tzoffset, tzname, epoch = time_operations(dt)
+
+    # Tune time functions for Checkpoint
+    epoch = epoch[:-3]
+
+    mt = env.from_string(
+        '{{ mark }} {{ iso }} {{ host }} qumulo - - - 127.0.0.1,"admin",api,fs_read_metadata,ok,2,"/",""'
+    )
+    message = mt.render(mark="<134>1", host=host, bsd=bsd, iso=iso)
+
+    sendsingle(message, setup_sc4s[0], setup_sc4s[1][514])
+
+    st = env.from_string(
+        'search _time={{ epoch }} index=infraops host="{{ host }}" sourcetype="qumulo:storage"'
+    )
+    search = st.render(
+        epoch=epoch, bsd=bsd, host=host, date=date, time=time, tzoffset=tzoffset
+    )
+
+    resultCount, eventCount = splunk_single(setup_splunk, search)
+
+    record_property("host", host)
+    record_property("resultCount", resultCount)
+    record_property("message", message)
+
+    assert resultCount == 1