Corrections and sourcetype definition

[nadidsky]

This Pull request is risky since it changes the definition of the sourcetype (it adds a prefix).
The change does:

1. Corrects the REGEX of assignment of sourcetype to take into account that should have a space between type and its values
2. Corrects the sourcetype to have a oci: prefix in order to be able to classify properly the different sourcetypes.
   The reason is because oci delivers many types and not having a common prefix is not really according to the recomendation of splunk of keeping the vendor and product in front of the sourcetype. In this case we dont add the vendor but could have been a solution
3. Creates an assignment of host dinamically by the instanceid of the event
4. Defines a proper TIME_FORMAT instead of relying in the default
5. Adds the call the transforms that reassigns also the host

[vrich-100]

Thank you for the recommendations. Right now, there are in-sequence dependencies between the addon, here and the app (https://splunkbase.splunk.com/app/5289) that would need to be evaluated/changed to integrate these changes. Until then, we're going to wait on this pull request. But all points are valid and will be tested.

[nadidsky]

Hi Vivian, Cool, would it be published the app in GitHub? I will be pleased to contribute on it to ensure compatibility as much as I could. Best regards Nadidsky

…

On Fri, Apr 21, 2023, 19:26 Vivian Richards ***@***.***> wrote: Thank you for the recommendations. Right now, there are in-sequence dependencies between the addon, here and the app ( https://splunkbase.splunk.com/app/5289) that would need to be evaluated/changed to integrate these changes. Until then, we're going to wait on this pull request. But all points are valid and will be tested. — Reply to this email directly, view it on GitHub <#4 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AJQTXBYN45GYXEGANAQEYD3XCK7KZANCNFSM6AAAAAAXGVMNRQ> . You are receiving this because you authored the thread.Message ID: ***@***.***>

[nadidsky]

HI Vivian,

I've checked the app, https://splunkbase.splunk.com/app/5289. As of today the published version does not do much of use of the sourcetype, these are the files I have identified that should require a change:

./props.conf
./data/ui/views/oci_function_logs.xml

On oci_function_logs.xml there are several reference to sourcetype=SOMETHING. These should be appended with "oci:" to make it compatible. In props.conf the inclusion of the following should do the magic:
`
[oci:com.oraclecloud.vcn.flowlogs.DataEvent]

FIELDALIAS-oci_vcn_src_and_dest = "data.destinationAddress" ASNEW dest "data.destinationPort" ASNEW dest_port "data.sourceAddress" ASNEW src "data.sourcePort" ASNEW src_port destinationAddress ASNEW dest sourceAddress ASNEW src
`
I have created a version of the app in https://github.com/nadidsky/splunk_app_oci/tree/changes_for_oci_sourcetype_prefix (note I have removed the lookups, be aware of that on merging), there I have published what would seems the changes needed in the app.

I am really happy somebody is maintaining this apps

Thanks for reviewing and maintaining both!
Joan

[vrich-100]

For sure! The key is in the macros and saved searches. We're working on an update shortly and then I'll try to get the app in the splunk repository.

[ajdurr]

Is there any update?