create a10 networks filter for syslog messages

[amalitol]

Hi, @ikheifets-splunk,
This is the new ticket created per your request.

[ikheifets-splunk]

Hello @amalitol !
You sent me 2 .pcap files and the second (last) it's really incorrect. I opened it in WireShark and it's don't looks like a syslog messages. The first pcap is okay it's consisting real syslog messages.

P.S. I can implement filter for first .pcap file but as I understood you need to support both formats. If it would be CEF format then your message should be looks like that

[amalitol]

Yes @ikheifets-splunk,
I think we might need to support both formats using different "indexes" and "sourcetypes".
This is an ADC device. Notice the SYSTEM and AUDIT logs are in Syslog format and they are sent by the Management interfaces (IPs). The WAF logs are sent in a CEF format using the DATA interfaces (different IPs).
I'd like to propose you a couple of source types and indexes, similar to f5 bigIP:
1. a10networks:vthunder:[waf or cef] => index=netwaf
2. a10networks:vthunder:[system or Syslog] => index=netops

Thank you again.

[ikheifets-splunk]

@amalitol please update on version 3.4.0