feat: add parser for powertech interact

splunk · Oct 23, 2023 · 526597e · 526597e
1 parent dbc7fe8
commit 526597e
Show file tree

Hide file tree

Showing 2 changed files with 52 additions and 0 deletions.
diff --git a/docs/sources/vendor/Powertech/interact.md b/docs/sources/vendor/Powertech/interact.md
@@ -0,0 +1,31 @@
+# PowerTech Interact
+
+## Key facts
+
+* MSG Format based filter
+* CEF Format default port 514
+
+## Links
+
+| Ref                         | Link                                                                                       |
+|-----------------------------|--------------------------------------------------------------------------------------------|
+| Splunk Add-on               | None                                                                                       |
+
+
+## Sourcetypes
+
+| sourcetype                  | notes                                                                                      |
+|-----------------------------|--------------------------------------------------------------------------------------------|
+| PowerTech:Interact:cef      | CEF                                                                                        |
+
+## Source
+
+| source                      | notes                                                                                      |
+|-----------------------------|--------------------------------------------------------------------------------------------|
+| PowerTech:Interact:cef      | None                                                                                       |
+
+### Index Configuration
+
+| key                | source              | index                  | notes          |
+|--------------------|---------------------|------------------------|----------------|
+|PowerTech_Interact  | PowerTech:Interact  | netops                 | none           |
diff --git a/package/etc/conf.d/conflib/cef/app-cef-powertech_interact.conf b/package/etc/conf.d/conflib/cef/app-cef-powertech_interact.conf
@@ -0,0 +1,21 @@
+block parser app-cef-power_interact() {
+    channel {
+        rewrite {
+            r_set_splunk_dest_default(
+                index('netops'),
+                source('PowerTech:Interact'),
+                sourcetype('PowerTech:Interact:cef')
+                vendor('PowerTech')
+                product('Interact')
+            );
+        };
+    };
+};
+
+application app-cef-power_interact[cef] {
+    filter{
+        match("PowerTech" value(".metadata.cef.device_vendor"))
+        and match("Interact" value(".metadata.cef.device_product"));
+    };
+    parser { app-cef-power_interact(); };
+};