docs: create parsers detailed doc by Kawron · Pull Request #2992 · splunk/splunk-connect-for-syslog

Kawron · 2026-03-30T06:45:17Z

Updated documentation with more details on how to create parsers. I recommend reviewing this live

docs/creating_parsers/index.md

docs/creating_parsers/filter_message.md

docs/creating_parsers/index.md

docs/creating_parsers/parse_message.md

ajasnosz · 2026-03-30T09:29:46Z

docs/troubleshooting/troubleshoot_resources.md

+09:54:26.051644 IP (tos 0x0, ttl 64, id 29465, offset 0, flags [DF], proto UDP (17), length 466)
+10.202.22.239.41151 > 10.202.33.242.syslog: SYSLOG, length: 438
+Facility local0 (16), Severity info (6)
+Msg: 2022-04-28T16:16:15.466731-04:00 NTNX-21SM6M510425-B-CVM audispd[32075]: node=ntnx-21sm6m510425-b-cvm type=SYSCALL msg=audit(1651176975.464:2828209): arch=c000003e syscall=2 success=yes exit=6 a0=7f2955ac932e a1=2 a2=3e8 a3=3 items=1 ppid=29680 pid=4684 auid=1000 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=964698 comm=“sshd” exe=“/usr/sbin/sshd” subj=system_u:system_r:sshd_t:s0-s0:c0.c1023 key=“logins”\0x0a


This is not very standard looking, maybe we can add another example that was similar to the deleted one?

I will replace it with the simpler one, this one is too complicated, besides we shouldn't provide documentaion on how to use tcpdump

docs/sources/index.md

docs/creating_parsers/index.md

docs/creating_parsers/parse_message.md

docs/creating_parsers/unit_tests.md

ajasnosz · 2026-04-01T13:17:32Z

docs/creating_parsers/index.md

+
+* Make sure you have read our [contribution standards](../CONTRIBUTING.md).
+* Obtain a raw log message that you want to parse. If you do not know how to do it, refer to [Obtain raw message events](../troubleshooting/troubleshoot_resources.md#obtain-raw-message-events).
+* Create a new branch in the repository where you will apply your changes.


I would remove this point from here if we moved all the contribution points to different place

I deleted it completely, I think this is obvious that if someone wants to contribute then they need to create a branch

ajasnosz · 2026-04-01T13:25:39Z

docs/creating_parsers/index.md

+     If you find a similar parser in SC4S, you can use it as a reference. In the parser, make sure you assign the proper sourcetype, index, vendor, product, and template. The template shows how your message should be parsed before sending them to Splunk.
+
+
+The application filter will match all messages that start with the string `Carbon Black App Control event:`, and those events will be parsed by `block parser app-syslog-vmware_cb-protect()`. This parser then will route the message to index: `epintel`, set the sourcetype, source, vendor and product fields, and use speciefed template.


typo: speciefed -> specified

ajasnosz · 2026-04-01T13:27:21Z

docs/creating_parsers/index.md

+
+### Adding parser to SC4S Lite package
+
+For SC4S lite, parsers are grouped into `addons`. Create a folder (if it doesn't already exist) in `package/lite/etc/addons` with the name of vendor. In this folder also create an `addon_metadata.yaml` file with vendor name:


ajasnosz · 2026-04-01T13:29:19Z

docs/sources/vendor/Cisco/cisco_meraki.md

@@ -3,7 +3,7 @@
 ## Key facts
 * Cisco Meraki messages are not distinctive, which means that it's impossible to parse the sourcetype based on the log message.


but generally in the future I would keep pr strictly for what they are so here - for the parser doc and fix different typos in separate otherwise it might grow infinitely and be harder to review

ajasnosz · 2026-04-01T13:32:16Z

docs/sources/index.md

-* Common Event Format [CEF](https://splunk.github.io/splunk-connect-for-syslog/main/sources/base/cef/) Also known as ArcSight format
-* Log Extended Format [LEEF](https://splunk.github.io/splunk-connect-for-syslog/main/sources/base/leef/)
+Sources that are *compliant* with RFC 5424, RFC 5425, RFC 5426, or RFC 6587 can be onboarded as [simple sources](simple.md).
+


3 points were removed, I think we can keep them there

I think I can add the RFC3164 point because that's actually important, because it states that it can be used with simple sources. But two next points make no sens to be in the same list. That would suggest that cef and leef also can be onboard with simple sources but that's not true. I can add another paragraph for them

ajasnosz · 2026-04-01T13:34:43Z

docs/troubleshooting/troubleshoot_resources.md

+
+    * For most other sourcetypes, the `RAWMSG` is not displayed, but can be
+    viewed by changing the output template to one of the JSON variants, including t_JSON_3164 or t_JSON_5424, depending on RFC message type. See
+    [SC4S metadata configuration](https://splunk-connect-for-syslog.readthedocs.io/en/develop/configuration/#sc4s-metadata-configuration) for


I think this link can point to specific file not by develop

docs/troubleshooting/troubleshoot_resources.md

tests/test_healthcheck_queue_size_limit.py

docs/troubleshooting/troubleshoot_resources.md

docs/sources/index.md

docs/creating_parsers/index.md

docs/creating_parsers/parse_message.md

docs/creating_parsers/unit_tests.md

Kawron requested review from ajasnosz and sbylica-splunk March 30, 2026 06:45

Kawron requested a review from rjha-splunk as a code owner March 30, 2026 06:45

sbylica-splunk requested changes Mar 30, 2026

View reviewed changes

docs/creating_parsers/index.md Outdated Show resolved Hide resolved

docs/creating_parsers/index.md Outdated Show resolved Hide resolved

Kawron requested a review from digrajpu March 30, 2026 08:49

ajasnosz requested changes Mar 30, 2026

View reviewed changes

docs/creating_parsers/index.md Outdated Show resolved Hide resolved

Kawron force-pushed the docs/update-create-parser-section branch from c2a084f to 2c631c0 Compare March 30, 2026 12:45

Kawron requested review from ajasnosz and sbylica-splunk March 30, 2026 12:45

Base automatically changed from develop to main March 31, 2026 07:14

ajasnosz changed the base branch from main to develop March 31, 2026 09:06

Kawron added 5 commits March 31, 2026 12:01

docs: create parsers detailed doc

fe8f0fd

docs: suggested changes

b24cb62

docs: PR suggestions

120c2c7

docs: fix hardcoded link to documentation

fe79c5c

docs: suggested changes 2

0b69b78

Kawron force-pushed the docs/update-create-parser-section branch from 2c631c0 to 0b69b78 Compare March 31, 2026 10:01

sbylica-splunk reviewed Apr 1, 2026

View reviewed changes

docs/creating_parsers/parse_message.md Outdated Show resolved Hide resolved

sbylica-splunk reviewed Apr 1, 2026

View reviewed changes

docs/creating_parsers/parse_message.md Outdated Show resolved Hide resolved

sbylica-splunk reviewed Apr 1, 2026

View reviewed changes

docs/creating_parsers/unit_tests.md Outdated Show resolved Hide resolved

sbylica-splunk reviewed Apr 1, 2026

View reviewed changes

docs/creating_parsers/unit_tests.md Outdated Show resolved Hide resolved

ajasnosz requested changes Apr 1, 2026

View reviewed changes

sbylica-splunk reviewed Apr 2, 2026

View reviewed changes

docs/troubleshooting/troubleshoot_resources.md Outdated Show resolved Hide resolved

docs: suggested changes 3

a2cb0b2

Kawron force-pushed the docs/update-create-parser-section branch from e150ba6 to a2cb0b2 Compare April 2, 2026 07:25

Kawron requested review from ajasnosz and sbylica-splunk April 2, 2026 07:26

sbylica-splunk reviewed Apr 2, 2026

View reviewed changes

docs: remove empty file

ddaf975

docs: suggested changes 4

0f62b0d

Kawron requested a review from sbylica-splunk April 3, 2026 08:18

sbylica-splunk approved these changes Apr 7, 2026

View reviewed changes

		If you find a similar parser in SC4S, you can use it as a reference. In the parser, make sure you assign the proper sourcetype, index, vendor, product, and template. The template shows how your message should be parsed before sending them to Splunk.


		The application filter will match all messages that start with the string `Carbon Black App Control event:`, and those events will be parsed by `block parser app-syslog-vmware_cb-protect()`. This parser then will route the message to index: `epintel`, set the sourcetype, source, vendor and product fields, and use speciefed template.


		### Adding parser to SC4S Lite package

		For SC4S lite, parsers are grouped into `addons`. Create a folder (if it doesn't already exist) in `package/lite/etc/addons` with the name of vendor. In this folder also create an `addon_metadata.yaml` file with vendor name:

		@@ -3,7 +3,7 @@
		## Key facts
		* Cisco Meraki messages are not distinctive, which means that it's impossible to parse the sourcetype based on the log message.

Conversation

Kawron commented Mar 30, 2026

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants