Parser for Semperis DSP logs

[muditrao82]

What is the sc4s version ?
sc4s version=2.49.8
Is there a pcap available?
attached in log files.

What the vendor name?
Semperis DSP

What's the product name?
Semperis DSP

** Feature Request description: **
Logs parser for Semperis DSP

** Should it support TCP or UDP?**
UDP

** Do you want to have it for local usage or prepare a github PR? **
demologs.txt

[ikheifets-splunk]

Its seems that is already duplicating discussion on Splunk user group

[ikheifets-splunk]

@muditrao82 are you solved this issue already in splunk user group? If yes, I think you can make pull request here, we are an open source project. If you don't published this question we can ask to share parser from "Splunk user group"

[muditrao82]

@ikheifets-splunk this issue has not been resolved from Splunk user group. My main technical contact and SE at Splunk informed me that you were working on completing the parser for Semperis DSP logs. What is the current status and when will this be completed?

[ikheifets-splunk]

Hello, @muditrao82 !
I created a pull request for this issue.
If you wanna test it before release please pull development sc4s version

[muditrao82]

Hello, I have download the parser and it’s not parsing any of the fields. Only source type is correct.

…

On Mon, Nov 6, 2023 at 17:57 Ilya ***@***.***> wrote: Hello, @muditrao82 <https://github.com/muditrao82> ! I linked a pull request to this issue. If you wanna test it before release you can pull development version ghcr.io/splunk/splunk-connect-for-syslog/container3:pr-2259 — Reply to this email directly, view it on GitHub <#2211 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/BC5QICXVTIJMHDHFBHWS3NLYDF2NPAVCNFSM6AAAAAA5MZBU7OVHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTOOJXGA2TCNRWGE> . You are receiving this because you were mentioned.Message ID: ***@***.***>

[ikheifets-splunk]

Hello, @muditrao82 !

Usually we not parsing such formats and only identifying vendor and product.
But after you mentioned that important for you, it I updated my PR and it's working like that:

P.S. Hope that it would be okay for you