Merged

.gitignore

@@ -303,6 +303,7 @@ tags
 # Persistent undo
 [._]*.un~
 
+<<<<<<< HEAD
 # Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio and WebStorm
 # Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839
 
@@ -377,3 +378,11 @@ fabric.properties
 !/package/scripts/splunkmetrics.sh
 !/package/scripts/
 .ecs
+=======
+/test-results/
+/.idea/workspace.xml
+/.idea/tasks.xml
+!/package/scripts/switch_transport.sh
+!/package/scripts/splunkmetrics.sh
+!/package/scripts/
+>>>>>>> master

package/Dockerfile

@@ -90,6 +90,7 @@ COPY sbin/entrypoint.sh /sbin/entrypoint.sh
 RUN mkdir -p /opt/syslog-ng/var/data/disk-buffer
 RUN source scl_source enable rh-python36 ;/opt/syslog-ng/sbin/syslog-ng  -V
 RUN source scl_source enable rh-python36 ;/opt/syslog-ng/sbin/syslog-ng -t
+RUN mkdir -p /var/log/syslog-ng/data/disk-buffer
 
 EXPOSE 514
 EXPOSE 601/tcp

package/etc/conf.d/destinations/d_destinations.conf

@@ -49,7 +49,6 @@ destination d_hec {
         );
     };
 
-
 destination d_hecmetrics {
     http(
          url("`SPLUNK_HEC_URL`")

package/etc/context/splunk_index.csv

@@ -2,6 +2,7 @@ cisco:asa,index,main
 cisco:asa,sourcetype,cisco:asa
 cisco:ios,index,main
 cisco:ios,sourcetype,cisco:ios
+<<<<<<< HEAD
 fgt_event,sourcetype,fgt_event
 fgt_event,index,main
 fgt_log,sourcetype,fgt_log
@@ -10,6 +11,8 @@ fgt_traffic,sourcetype,fgt_traffic
 fgt_traffic,index,main
 fgt_utm,sourcetype,fgt_utm
 fgt_utm,index,main
+=======
+>>>>>>> master
 pan:traffic,index,main
 pan:threat,index,main
 pan:system,index,main
@@ -31,4 +34,4 @@ syslog-ng:events,sourcetype,syslog-ng:events
 syslog-ng:fallback,index,main
 syslog-ng:fallback,sourcetype,syslog-ng:fallback
 syslog-ng:metrics,index,em_metrics
-syslog-ng:metrics,sourcetype,httpevent
+syslog-ng:metrics,sourcetype,httpevent

package/etc/syslog-ng.conf

@@ -21,6 +21,10 @@ options {
         chain_hostnames (off);
         use_dns (no);
         use_fqdn (no);
+<<<<<<< HEAD
+=======
+        dns-cache(no);
+>>>>>>> master
         create_dirs (no);
         keep-hostname (yes);
         create_dirs(yes);
@@ -60,10 +64,17 @@ options {
 # ===============================================================================================
 @define ip-version 4
 @define splunk-max-connections 1000
+<<<<<<< HEAD
 @define splunk-log-fifo-size 180000000
 @define splunk-fetch-limit 20000
 # make sure splunk-window-size >= splunk-max-connections * splunk-fetch-limit
 @define splunk-window-size 20000000
+=======
+@define splunk-log-fifo-size 10000
+@define splunk-fetch-limit 100
+# make sure splunk-window-size >= splunk-max-connections * splunk-fetch-limit
+@define splunk-window-size 100000
+>>>>>>> master
 @define splunk-rcvbuf 425984
 @define default-timezone "GMT"