From d08cd20b1765d01f13e1b09e572ae75e03165669 Mon Sep 17 00:00:00 2001 From: mbonsack Date: Tue, 17 Sep 2019 15:57:36 -0700 Subject: [PATCH] Fix/dynamic template (#82) * Template fixes Add dynamic templates Introduce new t_JSON_5424 template Add default source * change default source preamble change source preamble to sc4s per official branding --- .../etc/conf.d/conflib/_common/templates.conf | 21 ++++++++++++++++--- .../conf.d/conflib/_splunk/splunkfields.conf | 13 +++++------- .../etc/conf.d/destinations/splunk_hec.conf | 2 +- .../log_paths/P_rfc3164-juniper_nsm_idp.conf | 6 ++---- package/etc/conf.d/log_paths/internal.conf | 4 ++-- .../log_paths/p_rfc3164-cisco-nx-os.conf | 7 +++---- .../conf.d/log_paths/p_rfc3164-cisco_asa.conf | 6 ++---- .../conf.d/log_paths/p_rfc3164-cisco_ios.conf | 6 ++---- .../log_paths/p_rfc3164-fortinet_fortios.conf | 11 ++++------ .../log_paths/p_rfc3164-juniper-idp.conf | 7 +++---- .../log_paths/p_rfc3164-juniper-junos.conf | 14 ++++++------- .../p_rfc3164-juniper_netscreen.conf | 6 ++---- .../log_paths/p_rfc3164-juniper_nsm.conf | 6 ++---- .../log_paths/p_rfc3164-paloalto-panos.conf | 20 +++++++----------- .../p_rfc5424_noversion-cisco_asa.conf | 6 ++---- .../p_rfc_5424_noversion-symantec-proxy.conf | 8 +++---- .../p_rfc_5424_strict-juniper-junos.conf | 19 ++++++++--------- package/etc/conf.d/log_paths/zfallback.conf | 3 +-- package/etc/context-local/splunk_index.csv | 5 +++++ package/etc/syslog-ng.conf | 3 ++- 20 files changed, 83 insertions(+), 90 deletions(-) diff --git a/package/etc/conf.d/conflib/_common/templates.conf b/package/etc/conf.d/conflib/_common/templates.conf index b07a8a5..5efd586 100644 --- a/package/etc/conf.d/conflib/_common/templates.conf +++ b/package/etc/conf.d/conflib/_common/templates.conf @@ -44,13 +44,28 @@ template t_hdr_sdata_msg { }; # =============================================================================================== -# JSON; for JSON pretty-printing +# JSON; for JSON pretty-printing (for debugging) # =============================================================================================== - + template t_JSON { template("$(format-json --scope all-nv-pairs --exclude fields.* --exclude .splunk.* - --exclude HOST --exclude HOSTFROMgit m + --exclude HOST + --exclude HOST_FROM + )"); + }; + +# =============================================================================================== +# JSON; for JSON pretty-printing (for RFC5424) +# =============================================================================================== + +template t_JSON_5424 { + template("$(format-json --scope all-nv-pairs + --exclude fields.* + --exclude .splunk.* + --exclude HOST + --exclude HOST_FROM + --exclude RAWMSG )"); }; diff --git a/package/etc/conf.d/conflib/_splunk/splunkfields.conf b/package/etc/conf.d/conflib/_splunk/splunkfields.conf index 3e1d2c9..68e9a01 100644 --- a/package/etc/conf.d/conflib/_splunk/splunkfields.conf +++ b/package/etc/conf.d/conflib/_splunk/splunkfields.conf @@ -2,8 +2,9 @@ rewrite r_set_splunk_default { set("`index`", value(".splunk.index")); - set("`sourcetype`", value(".splunk.sourcetype")); - set("`source`", value(".splunk.source")); + set("`splunk-sourcetype`", value(".splunk.sourcetype")); + set("`splunk-source`:$LOGHOST", value(".splunk.source")); + set("`splunk-template`", value(".splunk.template")); set($FACILITY, value("fields.sc4s_syslog_facility")); set($LEVEL, value("fields.sc4s_syslog_severity")); set($LOGHOST, value("fields.sc4s_syslog_server")); @@ -14,16 +15,12 @@ rewrite r_set_splunk_default { block rewrite r_set_splunk_dest_default( index() sourcetype() + template(`splunk-template`) ) { set("`index`", value(".splunk.index")); set("`sourcetype`", value(".splunk.sourcetype")); + set("`template`", value(".splunk.template")); }; -block rewrite r_set_splunk( - template(`splunk-default-template`) - ) { - set("`template`", value("fields.sc4s_template")); - }; - diff --git a/package/etc/conf.d/destinations/splunk_hec.conf b/package/etc/conf.d/destinations/splunk_hec.conf index 81f3187..0132bfe 100644 --- a/package/etc/conf.d/destinations/splunk_hec.conf +++ b/package/etc/conf.d/destinations/splunk_hec.conf @@ -45,7 +45,7 @@ destination d_hec { source=${.splunk.source} sourcetype=${.splunk.sourcetype} index=${.splunk.index} - event=$(template ${fields.sc4s_template} $(template `splunk-default-template`)) + event=$(template ${.splunk.template} $(template `splunk-template`)) fields.*)') ); }; diff --git a/package/etc/conf.d/log_paths/P_rfc3164-juniper_nsm_idp.conf b/package/etc/conf.d/log_paths/P_rfc3164-juniper_nsm_idp.conf index 740a10c..3e95c30 100644 --- a/package/etc/conf.d/log_paths/P_rfc3164-juniper_nsm_idp.conf +++ b/package/etc/conf.d/log_paths/P_rfc3164-juniper_nsm_idp.conf @@ -4,13 +4,11 @@ log { filter(f_is_rfc3164); filter(f_juniper_nsm_idp); - rewrite {r_set_splunk_dest_default(sourcetype("juniper:nsm:idp"), index("netids"))}; + rewrite {r_set_splunk_dest_default(sourcetype("juniper:nsm:idp"), index("netids"), template("t_standard"))}; parser { p_add_context_splunk(key("juniper_idp")); }; - rewrite { - r_set_splunk(template("t_standard")) - }; + destination(d_hec); #--HEC-- flags(flow-control); }; diff --git a/package/etc/conf.d/log_paths/internal.conf b/package/etc/conf.d/log_paths/internal.conf index 352c2ac..743c15c 100644 --- a/package/etc/conf.d/log_paths/internal.conf +++ b/package/etc/conf.d/log_paths/internal.conf @@ -30,10 +30,10 @@ log { }; destination(d_hecmetrics); #--HEC-- } else { - rewrite { r_set_splunk_dest_default(sourcetype("syslog-ng:events"), index("_internal"))}; + rewrite { r_set_splunk_dest_default(sourcetype("syslog-ng:events"), index("_internal"), template("t_msg_only"))}; parser {p_add_context_splunk(key("syslog-ng_events")); }; - rewrite {r_set_splunk(template("t_msg_only")) }; #--HEC-- + destination(d_hec); #--HEC-- }; }; \ No newline at end of file diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf index d282022..a0c1e8e 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-cisco-nx-os.conf @@ -3,13 +3,12 @@ log { source(s_default-ports); filter(f_cisco_nx_os); - rewrite { r_set_splunk_dest_default(sourcetype("cisco:ios"), index("netops"))}; + rewrite { r_set_splunk_dest_default(sourcetype("cisco:ios"), index("netops"), template("t_hdr_msg"))}; parser { p_add_context_splunk(key("cisco_nx_os")); }; - rewrite { - r_set_splunk(template("t_hdr_msg")) - }; + destination(d_hec); #--HEC-- + flags(flow-control); }; \ No newline at end of file diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf index f63aad9..866fa14 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-cisco_asa.conf @@ -9,13 +9,11 @@ log { filter(f_is_rfc3164); filter(f_cisco_asa); #set the source type based on program field and lookup index from the splunk context csv + #Using the 5424 parser the message content is all we need - rewrite { r_set_splunk_dest_default(sourcetype("cisco:asa"), index("netfw"))}; + rewrite { r_set_splunk_dest_default(sourcetype("cisco:asa"), index("netfw"), template("t_msg_only"))}; parser {p_add_context_splunk(key("cisco_asa")); }; - #Using the 5424 parser the message content is all we need - rewrite {r_set_splunk(template("t_msg_only")) }; #--HEC-- - destination(d_hec); #--HEC-- flags(flow-control); diff --git a/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf b/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf index bd4ce8d..09848fd 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-cisco_ios.conf @@ -9,13 +9,11 @@ log { filter(f_cisco_ios); - rewrite { r_set_splunk_dest_default(sourcetype("cisco:ios"), index("netops"))}; + rewrite { r_set_splunk_dest_default(sourcetype("cisco:ios"), index("netops"), template("t_msg_only"))}; parser { p_add_context_splunk(key("cisco_ios")); }; - rewrite { - r_set_splunk(template("t_msg_only")) #--HEC-- - }; + destination(d_hec); #--HEC-- flags(flow-control); diff --git a/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf b/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf index cd419db..0c451ed 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-fortinet_fortios.conf @@ -14,22 +14,19 @@ log { if (match("traffic" value(".kv.type"))) { - rewrite { r_set_splunk_dest_default(sourcetype("fgt_traffic"), index("netfw"))}; + rewrite { r_set_splunk_dest_default(sourcetype("fgt_traffic"), index("netfw"), template("t_standard"))}; parser {p_add_context_splunk(key("fortinet_fortios_traffic")); }; } elif (match("utm" value(".kv.type"))) { - rewrite { r_set_splunk_dest_default(sourcetype("fgt_utm"), index("netids"))}; + rewrite { r_set_splunk_dest_default(sourcetype("fgt_utm"), index("netids"), template("t_standard"))}; parser {p_add_context_splunk(key("fortinet_fortios_utm")); }; } elif (match("event" value(".kv.type"))) { - rewrite { r_set_splunk_dest_default(sourcetype("fgt_event"), index("netops"))}; + rewrite { r_set_splunk_dest_default(sourcetype("fgt_event"), index("netops"), template("t_standard"))}; parser {p_add_context_splunk(key("fortinet_fortios_event")); }; } else { - rewrite { r_set_splunk_dest_default(sourcetype("fgt_log"), index("netops"))}; + rewrite { r_set_splunk_dest_default(sourcetype("fgt_log"), index("netops"), template("t_standard"))}; parser {p_add_context_splunk(key("fortinet_fortios_log")); }; }; - #rewrite the final message for splunk json - #sourcetype and index are set in the filter defaults won't be used - rewrite {r_set_splunk(template("t_standard")) }; #--HEC-- destination(d_hec); #--HEC-- flags(flow-control); diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper-idp.conf b/package/etc/conf.d/log_paths/p_rfc3164-juniper-idp.conf index 82c9ecd..0f4db26 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper-idp.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-juniper-idp.conf @@ -4,13 +4,12 @@ log { filter(f_is_rfc5424_strict); filter(f_juniper_idp); - rewrite { r_set_splunk_dest_default(sourcetype("juniper:idp"), index("netids"))}; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:idp"), index("netids"), template("t_hdr_sdata_msg"))}; parser { p_add_context_splunk(key("juniper_idp")); }; - rewrite { - r_set_splunk(template("t_hdr_sdata_msg")) - }; + destination(d_hec); #--HEC-- + flags(flow-control); }; \ No newline at end of file diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper-junos.conf b/package/etc/conf.d/log_paths/p_rfc3164-juniper-junos.conf index b0106ca..f112311 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper-junos.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-juniper-junos.conf @@ -9,26 +9,26 @@ log { filter(f_juniper_junos_standard); if (program('RT_IDP')) { - rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:idp"), index("netids"))}; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:idp"), index("netids"), template("t_standard"))}; parser {p_add_context_splunk(key("juniper_idp")); }; } elif (program('RT_FLOW')) { - rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall"), index("netfw"))}; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall"), index("netfw"), template("t_standard"))}; parser {p_add_context_splunk(key("juniper_junos_flow")); }; } elif (program('RT_IDS')) { - rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:idp"), index("netids"))}; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:idp"), index("netids"), template("t_standard"))}; parser {p_add_context_splunk(key("juniper_junos_ids")); }; } elif (program('RT_UTM')) { - rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall"), index("netids"))}; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall"), index("netids"), template("t_standard"))}; parser {p_add_context_splunk(key("juniper_junos_utm")); }; } elif (program('Juniper')) { - rewrite { r_set_splunk_dest_default(sourcetype("juniper:sslvpn"), index("netfw"))}; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:sslvpn"), index("netfw"), template("t_standard"))}; parser {p_add_context_splunk(key("juniper_sslvpn")); }; } else { - rewrite { r_set_splunk_dest_default(sourcetype("juniper:legacy"), index("netops"))}; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:legacy"), index("netops"), template("t_standard"))}; parser {p_add_context_splunk(key("juniper_legacy")); }; }; - rewrite { r_set_splunk(template("t_standard")) }; destination(d_hec); #--HEC-- + flags(flow-control); }; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf b/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf index 0d3667d..f963649 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-juniper_netscreen.conf @@ -3,14 +3,12 @@ log { source(s_default-ports); filter(f_juniper_netscreen); - rewrite { r_set_splunk_dest_default(sourcetype("netscreen:firewall"), index("netfw"))}; + rewrite { r_set_splunk_dest_default(sourcetype("netscreen:firewall"), index("netfw"), template("t_standard"))}; parser { p_add_context_splunk(key("juniper_netscreen")); }; - rewrite { - r_set_splunk(template("t_standard")) - }; + destination(d_hec); #--HEC-- flags(flow-control); }; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf b/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf index 9d79fe1..645d7ea 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-juniper_nsm.conf @@ -8,14 +8,12 @@ log { filter(f_is_rfc3164); filter(f_juniper_nsm); - rewrite { r_set_splunk_dest_default(sourcetype("juniper:nsm"), index("netfw"))}; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:nsm"), index("netfw"), template("t_standard"))}; parser { p_add_context_splunk(key("juniper_nsm")); }; - rewrite { - r_set_splunk(template("t_standard")) - }; + destination(d_hec); #--HEC-- flags(flow-control); }; diff --git a/package/etc/conf.d/log_paths/p_rfc3164-paloalto-panos.conf b/package/etc/conf.d/log_paths/p_rfc3164-paloalto-panos.conf index a2ac570..9f1bb65 100644 --- a/package/etc/conf.d/log_paths/p_rfc3164-paloalto-panos.conf +++ b/package/etc/conf.d/log_paths/p_rfc3164-paloalto-panos.conf @@ -33,35 +33,31 @@ log { #set the source type based on program field and lookup index from the splunk context csv if (message(',\d+,THREAT')) { - rewrite { r_set_splunk_dest_default(sourcetype("pan:threat"), index("netproxy"))}; + rewrite { r_set_splunk_dest_default(sourcetype("pan:threat"), index("netproxy"), template("t_msg_only"))}; parser {p_add_context_splunk(key("pan_threat")); }; } elif (message(',\d+,TRAFFIC')) { - rewrite { r_set_splunk_dest_default(sourcetype("pan:traffic"), index("netfw"))}; + rewrite { r_set_splunk_dest_default(sourcetype("pan:traffic"), index("netfw"), template("t_msg_only"))}; parser {p_add_context_splunk(key("pan_traffic")); }; } elif (message(',\d+,SYSTEM')) { - rewrite { r_set_splunk_dest_default(sourcetype("pan:system"), index("netops"))}; + rewrite { r_set_splunk_dest_default(sourcetype("pan:system"), index("netops"), template("t_msg_only"))}; parser {p_add_context_splunk(key("pan_system")); }; } elif (message(',\d+,CONFIG')) { - rewrite { r_set_splunk_dest_default(sourcetype("pan:config"), index("netops"))}; + rewrite { r_set_splunk_dest_default(sourcetype("pan:config"), index("netops"), template("t_msg_only"))}; parser {p_add_context_splunk(key("pan_config")); }; } elif (message(',\d+,HIPWATCH')) { - rewrite { r_set_splunk_dest_default(sourcetype("pan:hipwatch"), index("main"))}; + rewrite { r_set_splunk_dest_default(sourcetype("pan:hipwatch"), index("main"), template("t_msg_only"))}; parser {p_add_context_splunk(key("pan_hipwatch")); }; } elif (message(',\d+,CORRELATION')) { - rewrite { r_set_splunk_dest_default(sourcetype("pan:correlation"), index("main"))}; + rewrite { r_set_splunk_dest_default(sourcetype("pan:correlation"), index("main"), template("t_msg_only"))}; parser {p_add_context_splunk(key("pan_correlation")); }; } elif (message(',\d+,USERID')) { - rewrite { r_set_splunk_dest_default(sourcetype("pan:userid"), index("netauth"))}; + rewrite { r_set_splunk_dest_default(sourcetype("pan:userid"), index("netauth"), template("t_msg_only"))}; parser {p_add_context_splunk(key("pan_userid")); }; } else { - rewrite { r_set_splunk_dest_default(sourcetype("pan:log"), index("netops"))}; + rewrite { r_set_splunk_dest_default(sourcetype("pan:log"), index("netops"), template("t_msg_only"))}; parser {p_add_context_splunk(key("pan_log")); }; }; - #rewrite the final message for splunk json - #sourcetype and index are set in the filter defaults won't be used - rewrite {r_set_splunk(template("t_msg_only")) }; #--HEC-- - destination(d_hec); #--HEC-- flags(flow-control); diff --git a/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf b/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf index ecc4459..de558e7 100644 --- a/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf +++ b/package/etc/conf.d/log_paths/p_rfc5424_noversion-cisco_asa.conf @@ -4,13 +4,11 @@ log { filter(f_cisco_asa); #set the source type based on program field and lookup index from the splunk context csv + #Using the 5424 parser the message content is all we need - rewrite { r_set_splunk_dest_default(sourcetype("cisco:asa"), index("netfw"))}; + rewrite { r_set_splunk_dest_default(sourcetype("cisco:asa"), index("netfw"), template("t_msg_only"))}; parser {p_add_context_splunk(key("cisco_asa")); }; - #Using the 5424 parser the message content is all we need - rewrite {r_set_splunk(template("t_msg_only")) }; #--HEC-- - destination(d_hec); #--HEC-- flags(flow-control); diff --git a/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec-proxy.conf b/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec-proxy.conf index 2c7085a..1d596bf 100644 --- a/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec-proxy.conf +++ b/package/etc/conf.d/log_paths/p_rfc_5424_noversion-symantec-proxy.conf @@ -3,15 +3,13 @@ log { filter(f_is_rfc5424_noversion); filter(f_symantec_bluecoat_proxy); - #set the source type based on program field and lookup index from the splunk context csv + #set the source type based on program field and lookup index from the splunk context csv. + #With the 5424 parser the message is the only portion needed in the template. - rewrite { r_set_splunk_dest_default(sourcetype("bluecoat:proxysg:access:kv"), index("netproxy"))}; + rewrite { r_set_splunk_dest_default(sourcetype("bluecoat:proxysg:access:kv"), index("netproxy"), template("t_msg_only")) }; parser {p_add_context_splunk(key("bluecoat_proxy")); }; - #Using the 5424 parser the message content is all we need - rewrite {r_set_splunk(template("t_msg_only")) }; #--HEC-- - destination(d_hec); #--HEC-- flags(flow-control); diff --git a/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper-junos.conf b/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper-junos.conf index 36505fb..56f064c 100644 --- a/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper-junos.conf +++ b/package/etc/conf.d/log_paths/p_rfc_5424_strict-juniper-junos.conf @@ -9,17 +9,17 @@ log { filter(f_juniper_junos_structured); if (program('RT_IDP')) { - rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:idp:structured"), index("netids")) }; - parser {p_add_context_splunk(key("juniper_idp")); }; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:idp:structured"), index("netids"), template("t_JSON_5424")) }; + parser {p_add_context_splunk(key("juniper_idp_structured")); }; } elif (program('RT_FLOW')) { - rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall:structured"), index("netfw")) }; - parser {p_add_context_splunk(key("juniper_junos_flow")); }; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall:structured"), index("netfw"), template("t_JSON_5424")) }; + parser {p_add_context_splunk(key("juniper_junos_flow_structured")); }; } elif (program('RT_IDS')) { - rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall:structured"), index("netids")) }; - parser {p_add_context_splunk(key("juniper_junos_ids")); }; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:idp:structured"), index("netids"), template("t_JSON_5424")) }; + parser {p_add_context_splunk(key("juniper_junos_ids_structured")); }; } elif (program('RT_UTM')) { - rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall:structured"), index("netids")) }; - parser {p_add_context_splunk(key("juniper_junos_utm")); }; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:junos:firewall:structured"), index("netfw"), template("t_JSON_5424")) }; + parser {p_add_context_splunk(key("juniper_junos_utm_structured")); }; } # Legacy Netscreen IDP is handled in the "p_rfc3164-juniper-idp.conf" log path # @@ -28,11 +28,10 @@ log { # parser {p_add_context_splunk(key("juniper_junos_idp")); }; # } else { - rewrite { r_set_splunk_dest_default(sourcetype("juniper:structured"), index("netops")) }; + rewrite { r_set_splunk_dest_default(sourcetype("juniper:structured"), index("netops"), template("t_JSON_5424")) }; parser {p_add_context_splunk(key("juniper_structured")); }; }; - rewrite { r_set_splunk(template("t_hdr_sdata_msg")) }; destination(d_hec); #--HEC-- diff --git a/package/etc/conf.d/log_paths/zfallback.conf b/package/etc/conf.d/log_paths/zfallback.conf index 1100605..3b5b7fc 100644 --- a/package/etc/conf.d/log_paths/zfallback.conf +++ b/package/etc/conf.d/log_paths/zfallback.conf @@ -1,12 +1,11 @@ log { source(s_default-ports); - rewrite { r_set_splunk_dest_default(sourcetype("syslog-ng:fallback"), index("main"))}; + rewrite { r_set_splunk_dest_default(sourcetype("syslog-ng:fallback"), index("main"), template("t_JSON")) }; parser { p_add_context_splunk(key("syslog-ng_fallback")); }; - rewrite { r_set_splunk(template("t_JSON"))}; #--HEC-- destination(d_hec); #--HEC-- flags(flow-control,fallback); }; diff --git a/package/etc/context-local/splunk_index.csv b/package/etc/context-local/splunk_index.csv index aa92083..71bcd53 100644 --- a/package/etc/context-local/splunk_index.csv +++ b/package/etc/context-local/splunk_index.csv @@ -7,6 +7,11 @@ #fortinet_fortios_traffic,index,netfw #fortinet_fortios_utm,index,netids #juniper_idp,index,netids +#juniper_structured,index,netops +#juniper_idp_structured,index,netids +#juniper_junos_flow_structured,index,netfw +#juniper_junos_ids_structured,index,netids +#juniper_junos_utm_structured,index,netfw #juniper_junos_flow,index,netfw #juniper_junos_ids,index,netids #juniper_junos_utm,index,netfw diff --git a/package/etc/syslog-ng.conf b/package/etc/syslog-ng.conf index 27e1a6e..bfb2c10 100644 --- a/package/etc/syslog-ng.conf +++ b/package/etc/syslog-ng.conf @@ -50,11 +50,12 @@ options { # =============================================================================================== @define splunk-sourcetype "syslog-ng:fallback" @define splunk-index "main" +@define splunk-source "sc4s" # =============================================================================================== # Default message template # =============================================================================================== -@define splunk-default-template "t_standard" +@define splunk-template "t_standard" # =============================================================================================== # Data collection parameters, buffers, and Timezone