SC4S parser

L_Petch — Thu, 31 Jul 2025 10:04:34 GMT

Hello,

I need to send all syslog data from opnsense to a specific index. As this is not a known vender source what is the easiest way to do this? I have seen that you can create a parser based on certain factors so guessing this would be the easiest way? If so does anyone have a good parser guide?

Re: SC4S parser

livehybrid — Thu, 31 Jul 2025 12:21:12 GMT

Hi @L_Petch

If you havent already, check out https://splunk.github.io/splunk-connect-for-syslog/2.44.2/gettingstarted/create-parser/ which has a guide on how to create custom parsers. This is probably the best way because it prevents finding a potentially fragile alternative process for identifying and routing the data (e.g. when it lands in Splunk with Props/Transforms).

Here is a sample to get you started:
In /opt/sc4s/local/config/app_parsers/

# app-opnsense.conf application app-opnsense[sc4s-network-source] { filter { program("filterlog" flags(prefix)) or program("opnsense" flags(prefix)) or host("opnsense*" type(glob)) or message("opnsense" flags(substring)) }; parser { p_set_netsource_fields( vendor("pfsense") # Use pfsense as base product("opnsense") ); }; };

Then create the destination in /opt/sc4s/local/config/destinations/:

# dest-opnsense.conf destination d_opnsense { splunk( class(splunk_hec) template("$(format-splunk-hec)") hec_token("YOUR_HEC_TOKEN") url("https://your-splunk:8088/services/collector/event") index("opnsense") source("${.splunk.source}") sourcetype("opnsense:syslog") ); }; log { source(s_network); filter(f_is_source_identified); if (match("opnsense" value("fields.sc4s_vendor"))) { destination(d_opnsense); flags(flow-control,final); }; };

🌟 Did this answer help you? If so, please consider:

Adding karma to show it was useful
Marking it as the solution if it resolved your issue
Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

Re: SC4S parser

L_Petch — Thu, 31 Jul 2025 13:03:08 GMT

Hi @livehybrid,

Thanks for this. I looked at the parsing documentation earlier. Is there not a simpler way to do this as I don't need to rewrite fields etc as I have a TA doing it. All I need is if syslog from this HOST/IP then send to index=opnsense, is this achievable with one parser config or is what you already stated the only way of doing it?

topic Re: SC4S parser in Getting Data In

SC4S parser

Re: SC4S parser

Re: SC4S parser