Docs Cleanup (#81)

Fixed filter references in Juniper; cleaned up main gettingstarted page
CSVD · Sep 11, 2019 · c964c07 · c964c07
1 parent 2422049
commit c964c07
Show file tree

Hide file tree

Showing 2 changed files with 4 additions and 55 deletions.
diff --git a/docs/gettingstarted.md b/docs/gettingstarted.md
@@ -67,7 +67,7 @@ Refer to [Splunk Enterprise](http://dev.splunk.com/view/event-collector/SP-CAAAE
 | [Docker CE + systemd single node](gettingstarted/docker-systemd-general.md) | First choice for Debian, Ubuntu, and CentOS distributions with limited existing docker experience |
 | [Docker CE + Swarm single node](gettingstarted/docker-swarm-general.md) | Option for Debian, Ubuntu, and CentOS  desiring swarm orchestration |
 | [Docker CE + Swarm single node RHEL 7.7](gettingstarted/docker-swarm-rhel7.md) | Option for RedHat 7.7 desiring swarm orchestration |
-=======
+
 # Pre-req
 
 * Linux host with Docker 19.x or newer with Docker Swarm enabled
@@ -76,60 +76,9 @@ Refer to [Splunk Enterprise](http://dev.splunk.com/view/event-collector/SP-CAAAE
 * One or more Splunk indexes for events collected by SC4S
 * Splunk HTTP event collector enabled with a token dedicated for SC4S
     * [Splunk Enterprise](http://dev.splunk.com/view/event-collector/SP-CAAAE6Q)
-    * [Splunk Enterprise Cloud](http://docs.splunk.com/Documentation/Splunk/7.3.1/Data/UsetheHTTPEventCollector#Configure_HTTP_Event_Collector_on_managed_Splunk_Cloud)
+    * [Splunk Cloud](http://docs.splunk.com/Documentation/Splunk/7.3.1/Data/UsetheHTTPEventCollector#Configure_HTTP_Event_Collector_on_managed_Splunk_Cloud)
 * A network load balancer (NLB) configured for round robin. Note: Special consideration may be required when more advanced products are used. The optimal configuration of the load balancer will round robin each http POST request (not each connection)
 
-# Setup
-
-* Create a directory on the server for configuration
-* Create a docker-compose.yml file based on the following template
-
-```yaml
-version: "3"
-services:
-  sc4s:
-    image: splunk/scs:latest
-    hostname: sc4s
-    ports:
-      - "514:514"
-      - "601:601"
-      - "514:514/udp"
-      - "5514:5514"
-      - "5514:5514/udp"
-    stdin_open: true
-    tty: true
-    environment:
-      - SPLUNK_HEC_URL=https://foo:8088/services/collector/event
-      - SPLUNK_HEC_TOKEN=<token>
-      - SPLUNK_CONNECT_METHOD=hec
-      - SPLUNK_DEFAULT_INDEX=<defaultindex>
-      - SPLUNK_METRICS_INDEX=em_metrics
-    volumes:
-    - ./sc4s/splunk_index.csv:/opt/syslog-ng/etc/context-local/splunk_index.csv
-    - ./sc4s/splunk_index.csv:/opt/syslog-ng/etc/context-local/splunk_index.csv
-```
-
-## Configure index destinations for Splunk 
-* Download the latest context.csv file to a subdirectory sc4s below the docker-compose.yml file created above
-```bash
-wget https://raw.githubusercontent.com/splunk/splunk-connect-for-syslog/master/package/etc/context-local/splunk_index.csv
-```
-* Edit splunk_index.csv review the index configuration and revise as required for sourcertypes utilized in your environment. For instance, add *cisco:asa,index,netfw* to splunk_index.csv for Cisco-ASA data source.
-
-## Configure sources by source IP or host name
-* This step is required even if not used
-* Download the latest vendor_product_by_source.conf file to a subdirectory sc4s below the docker-compose.yml file created above
-```bash
-wget https://raw.githubusercontent.com/splunk/splunk-connect-for-syslog/master/package/etc/context-local/vendor_product_by_source.conf
-```
-* Edit the file to identify appropriate vendor products by host glob or network mask using syslog-ng filter syntax.
-
-* Start SC4S
-
-```bash
-docker stack deploy --compose-file docker-compose.yml sc4s
-```
-
 
 ## Scale out
 

diff --git a/docs/sources.md b/docs/sources.md
@@ -284,7 +284,7 @@ Verify timestamp, and host values match as expected
 
 ### Filter type
 
-* Juniper NSM products must be identified by host or ip assignment. Update the filter `f_juniper_nsm` or `f_uniper_idp` as required
+* Juniper NSM products must be identified by host or ip assignment. Update the filter `f_juniper_nsm` or `f_juniper_nsm_idp` as required
 
 
 ### Setup and Configuration
@@ -328,7 +328,7 @@ Verify timestamp, and host values match as expected
 
 ### Filter type
 
-* Juniper Netscreen products must be identified by host or ip assignment. Update the filter `f_juniper_netscreen` or `juniper_idp` as required
+* Juniper Netscreen products must be identified by host or ip assignment. Update the filter `f_juniper_netscreen` or `f_juniper_idp` as required
 
 
 ### Setup and Configuration