Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

feat: Added an env variable to set source as 'sc4s' #2581

Merged
merged 2 commits into from
Sep 24, 2024
Merged

feat: Added an env variable to set source as 'sc4s' #2581

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
07d3435
feat: Added a env variable to provide provision of hardcoding source …
cwadhwani-splunk Sep 12, 2024
283797d
docs: Updated documentation with the details of the newly introduced …
cwadhwani-splunk Sep 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions docs/configuration.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -277,6 +277,16 @@ A syntax error will cause the runtime process to abort in the "preflight" phase

To update your changes, restart SC4S.

### Set source value as 'sc4s'

User can set the source field value to 'sc4s' by using the `SC4S_SET_SOURCE_AS_SC4S` variable.

**Note:** If the source field value is specified in a local parser or the splunk_metadata.csv file, it will take precedence over the `SC4S_SET_SOURCE_AS_SC4S` variable and overwrite the source field value.

| Variable | Values | Description |
|----------|---------------|-------------|
| SC4S_SET_SOURCE_AS_SC4S | yes or no(default) | Set the source field value to 'sc4s'. |

## Drop all data by IP or subnet (deprecated)

Using `vendor_product_by_source` to null queue is now a deprecated task. See the supported method for dropping data in [Filtering events from output](https://splunk.github.io/splunk-connect-for-syslog/main/sources/#filtering-events-from-output).
Expand Down
11 changes: 11 additions & 0 deletions package/etc/conf.d/sources/source_syslog/plugin.jinja
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -288,6 +288,11 @@ source s_{{ port_id }} {
};
};

{%- if set_source_sc4s == True %}
rewrite {
set("sc4s", value(".splunk.source"));
};
{%- endif %}

rewrite {
set($FACILITY, value("fields.sc4s_syslog_facility") condition(match('facility' template('`SC4S_DEST_SPLUNK_INDEXED_FIELDS`') type(string) flags(substring))));
Expand Down Expand Up @@ -475,6 +480,12 @@ source s_{{ port_id }} {
parser(app-group-sc4s-fallback);
};

{%- if set_source_sc4s == True %}
rewrite {
set("sc4s", value(".splunk.source"));
};
{%- endif %}

rewrite {
set($FACILITY, value("fields.sc4s_syslog_facility") condition(match('facility' template('`SC4S_DEST_SPLUNK_INDEXED_FIELDS`') type(string) flags(substring))));
set($LEVEL, value("fields.sc4s_syslog_severity") condition(match('severity' template('`SC4S_DEST_SPLUNK_INDEXED_FIELDS`') type(string) flags(substring)) ));
Expand Down
1 change: 1 addition & 0 deletions package/etc/conf.d/sources/source_syslog/plugin.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -133,5 +133,6 @@ def normalize_env_variable_input(env_variable: str):
ebpf_no_sockets=int(os.getenv("SC4S_EBPF_NO_SOCKETS", 4)),
enable_parallelize=normalize_env_variable_input(f"SC4S_ENABLE_PARALLELIZE"),
parallelize_no_partitions=int(os.getenv(f"SC4S_PARALLELIZE_NO_PARTITION", 4)),
set_source_sc4s=normalize_env_variable_input("SC4S_SET_SOURCE_AS_SC4S"),
)
print(outputText)
Loading