Getting Data In

SC4S parser

L_Petch
Path Finder

Hello,

 

I need to send all syslog data from opnsense to a specific index. As this is not a known vender source what is the easiest way to do this? I have seen that you can create a parser based on certain factors so guessing this would be the easiest way? If so does anyone have a good parser guide?

Labels (1)
0 Karma

livehybrid
Ultra Champion

Hi @L_Petch 

If you havent already, check out https://splunk.github.io/splunk-connect-for-syslog/2.44.2/gettingstarted/create-parser/ which has a guide on how to create custom parsers. This is probably the best way because it prevents finding a potentially fragile alternative process for identifying and routing the data (e.g. when it lands in Splunk with Props/Transforms).

Here is a sample to get you started:
In /opt/sc4s/local/config/app_parsers/

# app-opnsense.conf
application app-opnsense[sc4s-network-source] {
    filter {
        program("filterlog" flags(prefix))
        or program("opnsense" flags(prefix))
        or host("opnsense*" type(glob))
        or message("opnsense" flags(substring))
    };
    parser {
        p_set_netsource_fields(
            vendor("pfsense")  # Use pfsense as base
            product("opnsense")
        );
    };
};

Then create the destination in /opt/sc4s/local/config/destinations/:

# dest-opnsense.conf
destination d_opnsense {
    splunk(
        class(splunk_hec)
        template("$(format-splunk-hec)")
        hec_token("YOUR_HEC_TOKEN")
        url("https://your-splunk:8088/services/collector/event")
        index("opnsense")
        source("${.splunk.source}")
        sourcetype("opnsense:syslog")
    );
};

log {
    source(s_network);
    filter(f_is_source_identified);
    if (match("opnsense" value("fields.sc4s_vendor"))) {
        destination(d_opnsense);
        flags(flow-control,final);
    };
};

:glowing_star: Did this answer help you? If so, please consider:

  • Adding karma to show it was useful
  • Marking it as the solution if it resolved your issue
  • Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

L_Petch
Path Finder

Hi @livehybrid,

 

Thanks for this. I looked at the parsing documentation earlier. Is there not a simpler way to do this as I don't need to rewrite fields etc as I have a TA doing it. All I need is if syslog from this HOST/IP then send to index=opnsense, is this achievable with one parser config or is what you already stated the only way of doing it?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...