add cisco nx-os filter (#62)

package/etc/conf.d/conflib/vendor_cisco/nx-os.conf

@@ -0,0 +1,3 @@
+filter f_cisco_nx-os {
+    match("cisco_nx-os", value("fields.sc4s_vendor_product") type(glob) );
+};

package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf

@@ -0,0 +1,14 @@
+log {
+
+    source(s_default-ports);
+    filter(f_cisco_nx-os);
+
+    parser {
+            p_add_context_splunk(key("cisco:nx-os"));
+    };
+    rewrite {
+        r_set_splunk(template("t_standard"))
+    };
+    destination(d_hec);  #--HEC--
+    flags(flow-control);
+};

package/etc/context-local/splunk_index.csv

@@ -4,6 +4,8 @@ cisco:asa,index,main
 cisco:asa,sourcetype,cisco:asa
 cisco:ios,index,main
 cisco:ios,sourcetype,cisco:ios
+cisco:nx-os,index,main
+cisco:nx-os,sourcetype,cisco:nx-os
 fgt_event,sourcetype,fgt_event
 fgt_event,index,main
 fgt_log,sourcetype,fgt_log

package/etc/context-local/vendor_product_by_source.conf

@@ -22,4 +22,8 @@ filter f_juniper_idp {
 filter f_juniper_netscreen {
     host("jnpns-*" type(glob) )
     or match("juniper_netscreen" value("fields.sc4s_presume"))
+};
+filter f_cisco_nx-os {
+    host("csconx-*" type(glob) )
+    or match("cisco_nx-os" value("fields.sc4s_presume"))
 };

package/etc/context-local/vendor_product_by_source.csv

@@ -2,4 +2,5 @@ f_test_test,sc4s_vendor_product,"test_test"
 f_juniper_nsm,sc4s_vendor_product,"juniper_nsm"
 f_juniper_nsm_idp,sc4s_vendor_product,"juniper_nsm_idp"
 f_juniper_idp,sc4s_vendor_product,"juniper_idp"
-f_juniper_netscreen,sc4s_vendor_product,"juniper_netscreen"
+f_juniper_netscreen,sc4s_vendor_product,"juniper_netscreen"
+f_cisco_nx-os,sc4s_vendor_product,"cisco_nx-os"

tests/test_cisco_nx_os.py

@@ -0,0 +1,55 @@
+# Copyright 2019 Splunk, Inc.
+#
+# Use of this source code is governed by a BSD-2-clause-style
+# license that can be found in the LICENSE-BSD2 file or at
+# https://opensource.org/licenses/BSD-2-Clause
+
+from jinja2 import Environment
+
+from .sendmessage import *
+from .splunkutils import *
+
+env = Environment(extensions=['jinja2_time.TimeExtension'])
+
+# Nov 1 14:07:58 excal-113 %MODULE-5-MOD_OK: Module 1 is online
+def test_cisco_nx_os(record_property, setup_wordlist, get_host_key, setup_splunk):
+    host = get_host_key
+
+    mt = env.from_string(
+        "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} csconx-{{ host }} %MODULE-5-MOD_OK: Module 1 is online")
+    message = mt.render(mark="<111>", host=host)
+
+    sendsingle(message)
+
+    st = env.from_string("search index=main host=\"csconx-{{ host }}\" sourcetype=\"cisco:nx-os\" | head 2")
+    search = st.render(host=host)
+
+    resultCount, eventCount = splunk_single(setup_splunk, search)
+
+    record_property("host", host)
+    record_property("resultCount", resultCount)
+    record_property("message", message)
+
+    assert resultCount == 1
+
+# Nov 1 14:07:58 excal-113 %MODULE-5-MOD_OK: Module 1 is online
+# @pytest.mark.xfail
+#def test_cisco_nx_os_singleport(record_property, setup_wordlist, get_host_key, setup_splunk):
+#    host = get_host_key
+#
+#    mt = env.from_string(
+#        "{{ mark }} {% now 'utc', '%b %d %H:%M:%S' %} {{ host }} %MODULE-5-MOD_OK: Module 1 is online")
+#    message = mt.render(mark="<23>", host=host)
+#
+#    sendsingle(message, host="sc4s-nx-os")
+#
+#    st = env.from_string("search index=main host=\"{{ host }}\" sourcetype=\"cisco:nx-o\" | head 2")
+#    search = st.render(host=host)
+#
+#    resultCount, eventCount = splunk_single(setup_splunk, search)
+#
+#    record_property("host", host)
+#    record_property("resultCount", resultCount)
+#    record_property("message", message)
+#
+#    assert resultCount == 1