gitignore -- ignore local mount directory

.gitignore

@@ -383,3 +383,4 @@ fabric.properties
 
 tests/test_plugin_*.py
 # package/etc/conf.d/local/
+!package/etc/conf.d/local

package/etc/conf.d/local/context/compliance_meta_by_source.conf

@@ -0,0 +1,5 @@
+@version: 3.23
+filter f_test_test {
+    host("something-*" type(glob)) or
+    netmask(192.168.100.1/24)
+};

package/etc/conf.d/local/context/compliance_meta_by_source.csv

@@ -0,0 +1,2 @@
+#f_test_test,.splunk.index,"badindex"
+#f_test_test,fields.compliance,"pci"

package/etc/conf.d/local/context/splunk_index.csv

@@ -0,0 +1,40 @@
+#bluecoat_proxy,index,netproxy
+#cef_ArcSight_ArcSight,index,netwaf
+#cef_Incapsula_SIEMintegration,index,netwaf
+#cef_Microsoft_Microsoft Windows,index,oswinsec
+#cef_Microsoft_System or Application Event,index,oswin
+#cisco_asa,index,netfw
+#cisco_ios,index,netops
+#cisco_nx_os,index,netops
+#local_example,index,main
+#fortinet_fortios_event,index,netops
+#fortinet_fortios_log,index,netops
+#fortinet_fortios_traffic,index,netfw
+#fortinet_fortios_utm,index,netids
+#juniper_idp,index,netids
+#juniper_structured,index,netops
+#juniper_idp_structured,index,netids
+#juniper_junos_fw_structured,index,netfw
+#juniper_junos_ids_structured,index,netids
+#juniper_junos_utm_structured,index,netfw
+#juniper_junos_fw,index,netfw
+#juniper_junos_ids,index,netids
+#juniper_junos_utm,index,netfw
+#juniper_sslvpn,index,netfw
+#juniper_netscreen,index,netfw
+#juniper_nsm,index,netfw
+#juniper_nsm_idp,index,netids
+#juniper_legacy,index,netops
+#pan_traffic,index,netfw
+#pan_threat,index,netproxy
+#pan_system,index,netops
+#pan_config,index,netops
+#pan_hipwatch,index,main
+#pan_correlation,index,main
+#pan_userid,index,netauth
+#pan_unknown,index,netops
+#proofpoint_pps_filter,index,email
+#proofpoint_pps_sendmail,index,email
+#sc4s_events,index,main
+#sc4s_fallback,index,main
+#sc4s_metrics,index,em_metrics

package/etc/conf.d/local/context/vendor_product_by_source.conf

@@ -0,0 +1,37 @@
+@version: 3.22
+#TODO: #60 The syntax below uses regex and an indirect reference to a variable due to a
+#bug/limitation of selector files. The better syntax should be as follows
+#filter {match("f5_test" template("$(env PRESUME_SYSLOG)")); };
+
+filter f_test_test {
+    host("testvp-*" type(glob)) or
+    netmask(192.168.100.1/24)
+};
+filter f_juniper_nsm {
+    host("jnpnsm-*" type(glob)) or
+    netmask(192.168.1.0/24)
+};
+filter f_juniper_nsm_idp {
+    host("jnpnsmidp-*" type(glob)) or
+    netmask(192.168.2.0/24)
+};
+filter f_juniper_idp {
+    host("jnpidp-*" type(glob)) or
+    netmask(192.168.3.0/24)
+};
+filter f_juniper_netscreen {
+    host("jnpns-*" type(glob)) or
+    netmask(192.168.4.0/24)
+};
+filter f_cisco_nx_os {
+    host("csconx-*" type(glob)) or
+    netmask(192.168.5.0/24)
+};    
+filter f_proofpoint_pps_sendmail {
+    host("pps-*" type(glob)) or
+    netmask(192.168.6.0/24)
+};
+filter f_proofpoint_pps_filter {
+    host("pps-*" type(glob)) or
+    netmask(192.168.7.0/24)
+};

package/etc/conf.d/local/context/vendor_product_by_source.csv

@@ -0,0 +1,8 @@
+f_test_test,sc4s_vendor_product,"test_test"
+f_juniper_nsm,sc4s_vendor_product,"juniper_nsm"
+f_juniper_nsm_idp,sc4s_vendor_product,"juniper_nsm_idp"
+f_juniper_idp,sc4s_vendor_product,"juniper_idp"
+f_juniper_netscreen,sc4s_vendor_product,"juniper_netscreen"
+f_cisco_nx_os,sc4s_vendor_product,"cisco_nx_os"
+f_proofpoint_pps_sendmail,sc4s_vendor_product,"proofpoint_pps_sendmail"
+f_proofpoint_pps_filter,sc4s_vendor_product,"proofpoint_pps_filter"