A new parser for Dell Avamar logging about splunk-connect-for-syslog HOT 8 OPEN

Hello, @RichardHEB !

What is the sc4s version ?
pr-2259

Please use release version (for example 3.19.0 or latest), we asking customer test dev version only for test Pull Request is it working before release :)

Is there a pcap available?
Yes

Please send me on email: [email protected]

from splunk-connect-for-syslog.

Hello, @RichardHEB !
Haven't got pcap from you!

from splunk-connect-for-syslog.

Hi @ikheifets-splunk I had asked Andre (Splunk) to send it to you. He's had it since day one, I can email it to your Splunk email, do not want to posted open in public here. Am checking with Andre as well.

from splunk-connect-for-syslog.

thanks @RichardHEB finally received it, Andre shared with me.

from splunk-connect-for-syslog.

Hi Ilya, any updates on this one?

from splunk-connect-for-syslog.

Hello, @RichardHEB !
Please upgrade on our dev build to check that our parser working for you:
docker pull ghcr.io/splunk/splunk-connect-for-syslog/container3:pr-2393

We parsed your log message (I hide here sensitive data like ip, emails):

<141> Apr 05 18:19:55 MCS:BS::BACKUP::EDIT: <Code> 22555 <Type> AUDIT <Severity> PROCESS <Category> SECURITY <User> [email protected] <HwSource> amavar <Summary> Changed backup expiration. <path> /clients/Dev-Cert/Windows/test.com <createtime> 2024-02-03 02:32:09 CST <plugin> 3001 <labelnum> 388 <expiration> 2024-02-16 <requestor> <requestor domain="/" host="1.1.1.1" product="test" role="Administrator" user="[email protected]"/>

Will look at Splunk like this:

from splunk-connect-for-syslog.