https://community.splunk.com/t5/Getting-Data-In/How-to-create-your-own-add-on-How-to-parse-unusual-logs/m-p/687962#M114592 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/267362">@splunky_diamond</a>&nbsp;,</P><P>it's always a pleasure!</P><P>Ciao.</P><P>Giuseppe</P> Sun, 19 May 2024 10:00:10 GMT gcusello 2024-05-19T10:00:10Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-your-own-add-on-How-to-parse-unusual-logs/m-p/687958#M114589 <P>Hello Splunkers!<BR /><BR />I am collecting logs from Fudo PAM for which I haven't found any suitable existing add-on on the Splunk Base website. The logs are being collected over syslog, yet the regular "syslog" sourcetype doesn't suit the events coming from my source. I was searching the web for some tutorials on how to create your own add-on in Splunk in order to parse the unusual logs like in my case, but I haven't found any.&nbsp;<BR /><BR />Could someone please help me with that? Does anyone have any tutorial or guide on how to create your own parser, or can maybe explain what is needed for that, in case it's not a difficult task?<BR /><BR />If someone decides to provide answer themselves, by explaining how to create your own add-on, I would really appreciate detailed description that will involve such notes as: required skills, difficulty, how long it will take, and whether it's the best practice in such situations or there are more efficient ways.<BR /><BR />Again, the main goal for me is to get my logs from Fudo PAM (coming over syslog) parsed properly.&nbsp;<BR /><BR />Thank you for taking your time reading my post and replying to it <span class="lia-unicode-emoji" title=":red_heart:">❤️</span></P> Sun, 19 May 2024 07:52:11 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-your-own-add-on-How-to-parse-unusual-logs/m-p/687958#M114589 splunky_diamond 2024-05-19T07:52:11Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-your-own-add-on-How-to-parse-unusual-logs/m-p/687960#M114590 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/267362">@splunky_diamond</a>&nbsp;,</P><P>the best guide in ad-on creation is the Splunk Add-On Builder app (<A href="https://splunkbase.splunk.com/app/2962" target="_blank">https://splunkbase.splunk.com/app/2962</A>).</P><P>It guides you in the creation and in the normalization of your data to have a CIM compliant data flow that you can use also in ES or ITSI.</P><P>Ciao.</P><P>Giuseppe</P> Sun, 19 May 2024 09:18:15 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-your-own-add-on-How-to-parse-unusual-logs/m-p/687960#M114590 gcusello 2024-05-19T09:18:15Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-your-own-add-on-How-to-parse-unusual-logs/m-p/687961#M114591 <P>Thank you very much&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/161352">@gcusello</a>&nbsp;!&nbsp;<BR /><BR />You never fail to deliver best solutions for splunk newbies like me <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Sun, 19 May 2024 09:41:03 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-your-own-add-on-How-to-parse-unusual-logs/m-p/687961#M114591 splunky_diamond 2024-05-19T09:41:03Z https://community.splunk.com/t5/Getting-Data-In/How-to-create-your-own-add-on-How-to-parse-unusual-logs/m-p/687962#M114592 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/267362">@splunky_diamond</a>&nbsp;,</P><P>it's always a pleasure!</P><P>Ciao.</P><P>Giuseppe</P> Sun, 19 May 2024 10:00:10 GMT https://community.splunk.com/t5/Getting-Data-In/How-to-create-your-own-add-on-How-to-parse-unusual-logs/m-p/687962#M114592 gcusello 2024-05-19T10:00:10Z