Skip to content

Commit

Permalink
Cleanup in prep for re-name
Browse files Browse the repository at this point in the history
  • Loading branch information
rfaircloth-splunk committed Jun 15, 2020
1 parent a443b54 commit aa5ff27
Show file tree
Hide file tree
Showing 6 changed files with 8 additions and 12 deletions.
6 changes: 3 additions & 3 deletions docs/configuration.md
Original file line number Diff line number Diff line change
Expand Up @@ -158,7 +158,7 @@ page in this section:
|------------------------|---------------------|----------------|---------------|
| juniper_netscreen | netscreen:firewall | netfw | none |

Here is a snippet from the `splunk_indexes.csv` file:
Here is a snippet from the `splunk_index.csv` file:

```bash
juniper_netscreen,index,ns_index
Expand All @@ -185,7 +185,7 @@ In general, for most deployments the index should be the only change needed; oth
never be overridden (particularly for the "Out of the Box" data sources). Even then, care should be taken when considering any alternates,
as the defaults for SC4S were chosen with best practices in mind.

The `splunk_indexes.csv` file should also be appended to (with a "commented out" default for the index) when building custom SC4S log paths
The `splunk_index.csv` file should also be appended to (with a "commented out" default for the index) when building custom SC4S log paths
(filters). Care should be taken during filter design to choose appropriate index, sourctype and template defaults, so that admins are not
compelled to override them.

Expand All @@ -198,7 +198,7 @@ which maps to an associated lookup of alternate indexes, sources, or other metad
added to futher classify the data.

* The `conf` and `csv` files referenced below will be populated into the `/opt/sc4s/local/context` directory when SC4S is run for the first
time after being set up according to the "getting started" runtime documents, in a similar fashion to `splunk_indexes.csv`.
time after being set up according to the "getting started" runtime documents, in a similar fashion to `splunk_index.csv`.
After this first-time population of the files takes place, they can be edited (and SC4S restarted) for the changes to take effect. To get started:

* Edit the file ``compliance_meta_by_source.conf`` to supply uniquely named filters to identify events subject to override.
Expand Down
3 changes: 1 addition & 2 deletions docs/gettingstarted/docker-swarm-general.md
Original file line number Diff line number Diff line change
Expand Up @@ -86,8 +86,7 @@ and a filter (`example.conf`) in the `log_paths` and `filters` subdirectories, r
but copied as templates for your own log path development. They _will_ get overwritten at each SC4S start.

* In the `local/context` directory, if you change the "non-example" version of a file (e.g. `splunk_index.csv`) the changes
will be preserved on a restart. However, the "example" files _themselves_ (e.g. `splunk_index.csv.example`) will be updated
regularly, and should be used as a template to merge new/changed functionality into existing context files.
will be preserved on a restart.

* Create the subdirectory ``/opt/sc4s/archive``. This will be used as a mount point for local storage of syslog events
(if the optional mount is uncommented above). The events will be written in the syslog-ng EWMM format. See the "configuration"
Expand Down
3 changes: 1 addition & 2 deletions docs/gettingstarted/docker-swarm-rhel7.md
Original file line number Diff line number Diff line change
Expand Up @@ -94,8 +94,7 @@ and a filter (`example.conf`) in the `log_paths` and `filters` subdirectories, r
but copied as templates for your own log path development. They _will_ get overwritten at each SC4S start.

* In the `local/context` directory, if you change the "non-example" version of a file (e.g. `splunk_index.csv`) the changes
will be preserved on a restart. However, the "example" files _themselves_ (e.g. `splunk_index.csv.example`) will be updated
regularly, and should be used as a template to merge new/changed functionality into existing context files.
will be preserved on a restart.

* Create the subdirectory ``/opt/sc4s/archive``. This will be used as a mount point for local storage of syslog events
(if the optional mount is uncommented above). The events will be written in the syslog-ng EWMM format. See the "configuration"
Expand Down
3 changes: 1 addition & 2 deletions docs/gettingstarted/docker-systemd-general.md
Original file line number Diff line number Diff line change
Expand Up @@ -90,8 +90,7 @@ and a filter (`example.conf`) in the `log_paths` and `filters` subdirectories, r
but copied as templates for your own log path development. They _will_ get overwritten at each SC4S start.

* In the `local/context` directory, if you change the "non-example" version of a file (e.g. `splunk_index.csv`) the changes
will be preserved on a restart. However, the "example" files _themselves_ (e.g. `splunk_index.csv.example`) will be updated
regularly, and should be used as a template to merge new/changed functionality into existing context files.
will be preserved on a restart.

* Create the subdirectory ``/opt/sc4s/archive``. This will be used as a mount point for local storage of syslog events
(if the optional mount is uncommented above). The events will be written in the syslog-ng EWMM format. See the "configuration"
Expand Down
3 changes: 1 addition & 2 deletions docs/gettingstarted/podman-systemd-general.md
Original file line number Diff line number Diff line change
Expand Up @@ -109,8 +109,7 @@ and a filter (`example.conf`) in the `log_paths` and `filters` subdirectories, r
but copied as templates for your own log path development. They _will_ get overwritten at each SC4S start.

* In the `local/context` directory, if you change the "non-example" version of a file (e.g. `splunk_index.csv`) the changes
will be preserved on a restart. However, the "example" files _themselves_ (e.g. `splunk_index.csv.example`) will be updated
regularly, and should be used as a template to merge new/changed functionality into existing context files.
will be preserved on a restart.

* Create the subdirectory ``/opt/sc4s/archive``. This will be used as a mount point for local storage of syslog events
(if the optional mount is uncommented above). The events will be written in the syslog-ng EWMM format. See the "configuration"
Expand Down
2 changes: 1 addition & 1 deletion package/sbin/entrypoint.sh
Original file line number Diff line number Diff line change
Expand Up @@ -47,7 +47,7 @@ mkdir -p /opt/syslog-ng/etc/conf.d/local/config/
cp /opt/syslog-ng/etc/context_templates/* /opt/syslog-ng/etc/conf.d/local/context
for file in /opt/syslog-ng/etc/conf.d/local/context/*.example ; do cp --verbose -n $file ${file%.example}; done

#splunk_indexes.csv updates
#splunk_index.csv updates
#Remove comment headers from existing config
touch /opt/syslog-ng/etc/conf.d/local/context/splunk_index.csv
sed -i 's/^#//' /opt/syslog-ng/etc/conf.d/local/context/splunk_index.csv
Expand Down

0 comments on commit aa5ff27

Please sign in to comment.