Vendor product by source configuration

[Updog21]

Hi Team,

What is the current correct way for onboarding known vendor sources that require "vendor product by source configuration"?

Has configuring vendor_product_by_source.conf and vendor_product_by_source.csv been superseded by copying the parser provided at the bottom of the source document and updating the host filter?

Cheers

[rjha-splunk]

The latest way to do it using app_parsers ( they are documented well).https://splunk.github.io/splunk-connect-for-syslog/main/gettingstarted/create-parser/