SC4S parser

[L_Petch]

Hello,

I need to send all syslog data from opnsense to a specific index. As this is not a known vender source what is the easiest way to do this? I have seen that you can create a parser based on certain factors so guessing this would be the easiest way? If so does anyone have a good parser guide?

[livehybrid]

Hi @L_Petch 

If you havent already, check out https://splunk.github.io/splunk-connect-for-syslog/2.44.2/gettingstarted/create-parser/ which has a guide on how to create custom parsers. This is probably the best way because it prevents finding a potentially fragile alternative process for identifying and routing the data (e.g. when it lands in Splunk with Props/Transforms).

Here is a sample to get you started:
In /opt/sc4s/local/config/app_parsers/

# app-opnsense.conf
application app-opnsense[sc4s-network-source] {
    filter {
        program("filterlog" flags(prefix))
        or program("opnsense" flags(prefix))
        or host("opnsense*" type(glob))
        or message("opnsense" flags(substring))
    };
    parser {
        p_set_netsource_fields(
            vendor("pfsense")  # Use pfsense as base
            product("opnsense")
        );
    };
};

Then create the destination in /opt/sc4s/local/config/destinations/:

# dest-opnsense.conf
destination d_opnsense {
    splunk(
        class(splunk_hec)
        template("$(format-splunk-hec)")
        hec_token("YOUR_HEC_TOKEN")
        url("https://your-splunk:8088/services/collector/event")
        index("opnsense")
        source("${.splunk.source}")
        sourcetype("opnsense:syslog")
    );
};

log {
    source(s_network);
    filter(f_is_source_identified);
    if (match("opnsense" value("fields.sc4s_vendor"))) {
        destination(d_opnsense);
        flags(flow-control,final);
    };
};

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful
• Marking it as the solution if it resolved your issue
• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing

[L_Petch]

Hi @livehybrid,

Thanks for this. I looked at the parsing documentation earlier. Is there not a simpler way to do this as I don't need to rewrite fields etc as I have a TA doing it. All I need is if syslog from this HOST/IP then send to index=opnsense, is this achievable with one parser config or is what you already stated the only way of doing it?