feat: add hpe onboard administrator parser

docs/sources/vendor/HPe/oa.md

@@ -0,0 +1,20 @@
+# Onboard Administrator
+
+## Key facts
+
+* MSG Format based filter
+* Legacy BSD Format default port 514
+
+## Links
+
+## Sourcetypes
+
+| sourcetype | notes  |
+|------------|--------|
+| hpe:oa     | none   |
+
+### Index Configuration
+
+| key            | index      | notes          |
+|----------------|------------|----------------|
+| hpe_oa         | infraops   | none           |

package/etc/conf.d/conflib/syslog/app-syslog-hpe_oa.conf

@@ -0,0 +1,21 @@
+block parser app-syslog-hpe_oa() {
+ channel {
+        rewrite {
+            r_set_splunk_dest_default(
+                index("infraops")
+                sourcetype('hpe:oa')
+                vendor("hpe")
+                product("oa")
+                template("t_msg_only")
+            );
+        };
+
+   };
+};
+application app-syslog-hpe_oa[sc4s-syslog-pgm] {
+	filter {
+        program('OA' type(string) flags(prefix));
+    };	
+    parser { app-syslog-hpe_oa(); };
+
+};

tests/test_hpe_oa.py

@@ -0,0 +1,42 @@
+# license that can be found in the LICENSE-BSD2 file or at
+# https://opensource.org/licenses/BSD-2-Clause
+
+from jinja2 import Environment
+
+from .sendmessage import *
+from .splunkutils import *
+from .timeutils import *
+
+env = Environment()
+
+# <14>Jan 03 10:46:16 10.1.1.2 OA: Administrator logged out of the Onboard Administrator
+def test_hpe_oa(
+    record_property, setup_wordlist, get_host_key, setup_splunk, setup_sc4s
+):
+    host = get_host_key
+
+    dt = datetime.datetime.now(datetime.timezone.utc)
+    iso, bsd, time, date, tzoffset, tzname, epoch = time_operations(dt)
+
+    # Tune time functions
+    epoch = epoch[:-7]
+
+    mt = env.from_string(
+        "{{ mark }} {{ bsd }} {{ host }} OA: Administrator logged out of the Onboard Administrator\n"
+    )
+    message = mt.render(mark="<14>", bsd=bsd, host=host)
+
+    sendsingle(message, setup_sc4s[0], setup_sc4s[1][514])
+
+    st = env.from_string(
+        'search _time={{ epoch }} index=infraops host="{{ host }}" sourcetype="hpe:oa"'
+    )
+    search = st.render(bsd=bsd, host=host)
+
+    resultCount, eventCount = splunk_single(setup_splunk, search)
+
+    record_property("host", host)
+    record_property("resultCount", resultCount)
+    record_property("message", message)
+
+    assert resultCount == 1